topic Re: Use Field with Timestamp as Eventtime in Splunk Search

Use Field with Timestamp as Eventtime

RobertRi — Mon, 07 May 2018 09:30:10 GMT

Hi Community!

I have a problem with a German Timestamp Field!
I would like to extract the correct Timestamp from this field and replace it as the eventtime.
Unfortunatly monthnames are displayed at german language.

What is the best way to do that

This is my field with the timestamp

Mo Mai 07 2018 11:15:46.5650

and I would like to replace the eventtime with that timestamp

Thanks
Rob

Re: Use Field with Timestamp as Eventtime

xpac — Mon, 07 May 2018 10:09:40 GMT

Ha, Mai is actually the worst example 😉
Just wondering - is the timestamp only showing the first three letters of each month, or is it showing the full month name?

Re: Use Field with Timestamp as Eventtime

RobertRi — Mon, 07 May 2018 10:49:47 GMT

Only the first three letters.

Regards
Rob

Re: Use Field with Timestamp as Eventtime

FrankVl — Mon, 07 May 2018 11:32:54 GMT

Looks like you're not the only one who ran into this (no solution unfortunately):
https://answers.splunk.com/answers/468409/is-there-a-way-to-force-a-locale-so-that-splunk-re.html

Not directly related to index time processing of timestamps, but the search time documentation mentions that it follows the server's OS's locale setting:
http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Commontimeformatvariables

So you might want to try sending this data through a HF that is running on an OS set to German locale.

Alternatively, you could look at defining your own timestamp processor (creating an alternative datetime.xml).

I'd probably aim at fixing this from the data source side, rather than Splunk side...

Re: Use Field with Timestamp as Eventtime

xpac — Mon, 07 May 2018 13:07:58 GMT

Edit: Please ignore, that won't work.

I'd agree with @FrankVI and would try to fix the data, and would maybe do this during indexing (because you can most likely not change how you get the data on the source).

You should maybe look into a props.conf entry with SEDCMD, and just have 12 lines to replace each German abbreviation with the English one, and you would be done...

Re: Use Field with Timestamp as Eventtime

FrankVl — Mon, 07 May 2018 13:15:37 GMT

But would that SEDCMD be performed before Splunk does the timestamp extraction? Otherwise it is rather pointless, right?

Re: Use Field with Timestamp as Eventtime

xpac — Mon, 07 May 2018 13:29:48 GMT

You're right, my mistake, that wouldn't work...