topic How to extract time manually ? in Splunk Search

How to extract time manually ?

moiezuddin — Mon, 20 Apr 2015 14:40:30 GMT

What is the query to extract time manually for a span of minute?

Re: How to extract time manually ?

stephanefotso — Mon, 20 Apr 2015 17:42:25 GMT

Hello! Can i get your time format?

Re: How to extract time manually ?

juvetm — Mon, 20 Apr 2015 19:18:08 GMT

hi moiezuddin
can we have the time format pl

Re: How to extract time manually ?

moiezuddin — Tue, 21 Apr 2015 06:34:40 GMT

Sample Log

4/20/15
11:47:00.000 PM
[04/20/2015][20:47:40.461][2020398512][s3214933/r21][Center realm][][][][][][206450682][][][][][][centerusushwswp222lprd][** Status: Authorized. ][]

Re: How to extract time manually ?

rsennett_splunk — Tue, 21 Apr 2015 06:53:57 GMT

The way I read your question, "extract time manually for a span of minutes" it sounds like you want to include the earliest, and latest span in your search.

index=blah sourcetype=foo earliest="4/20/2015:20:00:00" latest="4/20/2015:20:22:00"|stats count by whatever

If you want to know how to get Splunk to extract either the first or second timestamp in your log, you will need to decide which one. They seem to be indicating different timezones as the first one is 11pm and the 2nd one is 8pm. So pick one...

Those are settings that you want to apply in props.conf. In fact, if it is the first one... just add LINE_BREAKER=([\r\n]+)\d\/\d{2}\/\d{2} to props.conf under the stanza for this source/sourcetype and Splunk will grab the first one. if you want the second one, then you would add LINE_BREAKER and TIME_PREFIX which in this case is nice and easy, as it begins with a left square bracket.

All together it would look like this:

[sourcetypename]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d\/\d{2}\/\d{2}
TIME_PREFIX = \[