topic Re: Field Extract and Format Time Stamp in Splunk Search

Field Extract and Format Time Stamp

jfeitosa — Tue, 29 Sep 2020 18:13:49 GMT

Hi All.

How to break this log block so that it reads each row as an event, and this log is not in timestamp format?

The date would be the start and end of the user session on the system.

The following is an example of the log:
cod|user |system |day|month|year|hour|minute|day|month|year|hour|minute
001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00821888|cis0121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46

Do I have to configure in props.conf and transform.conf by sourcetype?
REGEX = = (.{3}).(.{8}).(.{16}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2})
FORMAT = emp::$1 user::$2 session_id::$3 datei_mday::$4 datei_month::$5 datei_year::$6 datei_hour::$7 datei_minute::$8 datef_mday::$9 datef_month::$10 datef_year::$11 datef_hour::$12 datef_minute::$13

I tried to create this REGEX, but it did not work.

Can you help me please?

Best Regards.

Re: Field Extract and Format Time Stamp

493669 — Thu, 01 Mar 2018 15:48:34 GMT

set below in props.conf:

SHOULD_LINEMERGE = false

it will separate each line as an event

SHOULD_LINEMERGE = [true|false]
* When set to true, Splunk combines several lines of data into a single
  multi-line event, based on the following configuration attributes.
* Defaults to true.

Re: Field Extract and Format Time Stamp

danielasilva — Tue, 29 Sep 2020 18:13:54 GMT

If you have multiple events using the same line, then you should use the props that should look something like this:
props.conf:
[sourcetype]
TIME_PREFIX = depends on the timestamp you want
TIME_FORMAT = not sure what time you want to use - initial or final
MAX_TIMESTAMP_LOOKAHEAD = ?
SHOULD_LINEMERGE = true
LINE_BREAKER = |\d{2}(\s)\d+
TRUNCATE = 50000
REPORT-extraction = your_extraction

transfoms.conf:
[your_extraction]
DELIMS = "|"
FIELDS = emp, user, session_id, datei_mday, datei_month, datei_year, datei_hour, datei_minute, datef_mday, datef_month, datef_year, datef_hour, datef_minute

Hope it works!

Re: Field Extract and Format Time Stamp

jfeitosa — Thu, 01 Mar 2018 21:18:04 GMT

Thanks for the answer. I'll test and return with the result.
Thanks in advance.

Re: Field Extract and Format Time Stamp

jfeitosa — Thu, 01 Mar 2018 21:18:12 GMT

Thanks for the answer. I'll test and return with the result.
Thanks in advance.