topic Re: How do we handle white space in TIME_FORMAT? in Splunk Search

How do we handle white space in TIME_FORMAT?

ddrillic — Tue, 23 Apr 2019 17:53:03 GMT

I have a log file with events that start like - 2019-01-09 11:19:37 WARN.

We ended up using TIME_FORMAT=%Y-%m-%d%t%H:%M:%S and I don't like the %t (tab) part.

Is there a better way to handle the white space in TIME_FORMAT?

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Tue, 23 Apr 2019 19:42:05 GMT

The SE said -

You just leave a blank space;

TIME_FORMAT=%Y-%m-%d %H:%M:%S

Re: How do we handle white space in TIME_FORMAT?

adonio — Tue, 23 Apr 2019 23:35:44 GMT

Just a space " "

nothing more nothing else

sometimes you will see capital T
check out this example and see

| makeresults count=1
| eval time_with_space1 = "2019-01-09 11:19:37"
| eval time_with_space2 = "2019 01 09 11:19:37"
| eval time_with_space3 = "2019-01-09T11:19:37"
| eval check_that_time_format_works1 = strftime(strptime(time_with_space1, "%Y-%m-%d %H:%M:%S"), "%c")
| eval check_that_time_format_works2 = strftime(strptime(time_with_space2, "%Y %m %d %H:%M:%S"), "%c")
| eval check_that_time_format_works3 = strftime(strptime(time_with_space3, "%Y-%m-%dT%H:%M:%S"), "%c")

hope it helps

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Tue, 23 Apr 2019 23:41:00 GMT

Interesting, I added a couple of spaces here between and the date and the time -

 | eval time_with_space1 = "2019-01-09    11:19:37"

And it still works!!!

So, the space within "%Y-%m-%d %H:%M:%S" is stretchable, right?

My conclusion is that any combination of spaces and tabs in the data should be condensed to one space within TIME_FORMAT. I hope it's correct.

Re: How do we handle white space in TIME_FORMAT?

woodcock — Wed, 24 Apr 2019 00:50:33 GMT

You can use combinations of %r, %n, %t and a regular space character. The numbers are not important, but the order is.

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Wed, 24 Apr 2019 00:56:28 GMT

Thank you @woodcock !!!

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Wed, 24 Apr 2019 00:56:59 GMT

Thank you @adonio !!!

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Wed, 24 Apr 2019 01:31:28 GMT

@woodcock, will a tab in the data be captured by a space in TIME_FORMAT=%Y-%m-%d %H:%M:%S?

Re: How do we handle white space in TIME_FORMAT?

woodcock — Wed, 24 Apr 2019 01:48:56 GMT

No, you need to use %t.

Re: How do we handle white space in TIME_FORMAT?

ddrillic — Wed, 24 Apr 2019 13:37:06 GMT

Wow - a bit limiting ; -)

Re: How do we handle white space in TIME_FORMAT?

tomasmoser — Fri, 18 Sep 2020 11:48:32 GMT

Gregg, you made my day! Thx. I didn't know %r, %n, %s. Couldn't find anything about these in https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Commontimeformatvariables.

Again, great knowledge!