topic Re: Different date format in same log in Splunk Search

Different date format in same log

pero1234 — Fri, 01 Jul 2011 15:10:28 GMT

How can I pars this log with different date format?

data.log:

2011.06.30 16:06:11 data data data data bla bla
30.06.2011. 16:06:10 data data data bla bla data
...

Re: Different date format in same log

jbsplunk — Fri, 01 Jul 2011 15:38:02 GMT

Could you edit your question to clarify what you'd like to see in terms of a date format? Which of the two formats here would you like to include/exclude?

Re: Different date format in same log

dwaddle — Fri, 01 Jul 2011 15:57:21 GMT

You can't use TIME_FORMAT in this example, because that assumes there is a single timestamp format within the file.

It's possible that both of these formats are in datetime.xml already, which would let Splunk parse them without help. If not, you could make a custom datetime.xml that has both of these formats in it. That should let the timestamp parser differentiate between the two and parse appropriately.

http://www.splunk.com/base/Documentation/4.2.2/Data/TrainSplunkToRecognizeATimestamp#Createacustomdatetimexml

Re: Different date format in same log

pero1234 — Fri, 01 Jul 2011 19:52:57 GMT

I need include both date format. I need include everything in this log.

Re: Different date format in same log

pero1234 — Fri, 01 Jul 2011 20:02:23 GMT

THX for help. It seems that splunk correctly recognize and separate events without define sourcetype.
I try to define sourcetype=datalog and in props.conf define just stanza name without any options and works!