topic Re: Default _time in Splunk Search

Default _time

camah4 — Tue, 15 Nov 2011 16:11:00 GMT

I have an example log file with the following format:

Nov 05 10:33:37 servername applicationserver: instance,ipaddress,[05/Nov/2011:10:33:33 +0000]

I would like the second time column which contains [05/Nov/2011:10:33:33 +0000] to be column which is used for _time at index time, currently by default it uses Nov 05 10:33:37.

Any suggestion on how to tech splunk to use the alternative timestamp for _time would be appreciated.

Thanks

Re: Default _time

Takajian — Tue, 15 Nov 2011 16:39:11 GMT

You can extract timestamp as you want. Please see following manual. This will help your question.

http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Configuretimestamprecognition

Re: Default _time

tgow — Tue, 15 Nov 2011 16:58:18 GMT

Here is an example of a props.conf that could work:

[yoursourcetype]
TIME_PREFIX = ,\[
TIME_FORMAT = %d/%h/%Y:%T

You might need to change this depending on if you are using a 24-hour clock or not.

Re: Default _time

DUThibault — Wed, 15 May 2019 20:13:54 GMT

Version 4.2.4 is long dead. This link still works as of version 7.2.6 : https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition