https://community.splunk.com/t5/Splunk-Search/Redundant-Time-Values-in-Search/m-p/94627#M24426 <P>Hello Everyone! </P> <P>Thank you for your help. Our indexer currently has standard log4j logs as well as some custom logs. The issue occurs when we search for a log4j log (most of them are in this format) we have redundant time values. For example my search result will bring: </P> <P>»17/10/2012 22:12:45.904[This is the left hand side time with the dropdown arrow] and then the event shows 22:12:45.904 2012-10-17 22:12:45,904. </P> <P>Is there anyway to remove this redundancy? </P> <P>Please let me know if this is unclear. </P> <P>Thank you for your help.</P> Thu, 18 Oct 2012 13:54:08 GMT nowakdaw 2012-10-18T13:54:08Z https://community.splunk.com/t5/Splunk-Search/Redundant-Time-Values-in-Search/m-p/94627#M24426 <P>Hello Everyone! </P> <P>Thank you for your help. Our indexer currently has standard log4j logs as well as some custom logs. The issue occurs when we search for a log4j log (most of them are in this format) we have redundant time values. For example my search result will bring: </P> <P>»17/10/2012 22:12:45.904[This is the left hand side time with the dropdown arrow] and then the event shows 22:12:45.904 2012-10-17 22:12:45,904. </P> <P>Is there anyway to remove this redundancy? </P> <P>Please let me know if this is unclear. </P> <P>Thank you for your help.</P> Thu, 18 Oct 2012 13:54:08 GMT https://community.splunk.com/t5/Splunk-Search/Redundant-Time-Values-in-Search/m-p/94627#M24426 nowakdaw 2012-10-18T13:54:08Z https://community.splunk.com/t5/Splunk-Search/Redundant-Time-Values-in-Search/m-p/94628#M24427 <P>Hello All, </P> <P>I have figured this out. For all those interested: </P> <P>I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data. </P> <P>This page was very usefulfto me. <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles</A> </P> <P>Thank you all!</P> Thu, 18 Oct 2012 15:30:10 GMT https://community.splunk.com/t5/Splunk-Search/Redundant-Time-Values-in-Search/m-p/94628#M24427 nowakdaw 2012-10-18T15:30:10Z