topic timestamp lookahead in Splunk Search

timestamp lookahead

sarit_s — Tue, 18 Jun 2019 12:02:37 GMT

Hello

i have this event for example:

$changeSystemTimeCmd 1533808153 -newTime 1533808153 -oldTime 1533808147

i need to set the timestamp to take the first number after the first string. in this can it is

$changeSystemTimeCmd

but it can be any string.
i tried with timestamp lookahead 30 but the problem is that i can't know what will be the length of this first string
how can i set timestamp lookahead regex to take the first number after first string ?

Re: timestamp lookahead

harsmarvania57 — Tue, 18 Jun 2019 12:18:18 GMT

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

Re: timestamp lookahead

sarit_s — Wed, 30 Sep 2020 00:59:56 GMT

i don't have indexer or HF
im running on all in one configuration so the sourcetype configuration located on props.conf in the app

it is working ! can you please explain why MAX_TIMESTAMP_LOOKAHEAD=10 ?

Re: timestamp lookahead

harsmarvania57 — Wed, 30 Sep 2020 00:59:59 GMT

If you are running standalone splunk instance then also it will work. I have tested same config in Add Data in my lab splunk instance and it is working for me.

MAX_TIMESTAMP_LOOKAHEAD will count after TIME_PREFIX, in above config TIME_PREFIX regex cover till first whitespace so this $changeSystemTimeCmd is captured with TIME_PREFIX regex and after that you have 10 digit epoch time format so I have given 10 in MAX_TIMESTAMP_LOOKAHEAD

Re: timestamp lookahead

sarit_s — Wed, 30 Sep 2020 01:00:01 GMT

thanks for your answer
it is working

i see it is also work without MAX_TIMESTAMP_LOOKAHEAD
the thing is that im afraid that the epoch time will be with more than 10 digits so if it is not necessary to limit i think it will be better

what do you think ?

Re: timestamp lookahead

harsmarvania57 — Tue, 18 Jun 2019 12:35:56 GMT

If you do not set MAX_TIMESTAMP_LOOKAHEAD then it will take default value which is 128 character, I'll suggest to define MAX_TIMESTAMP_LOOKAHEAD with max length of your epoch time.