Archive

How to extract time manually ?

Explorer

What is the query to extract time manually for a span of minute?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

The way I read your question, "extract time manually for a span of minutes" it sounds like you want to include the earliest, and latest span in your search.

index=blah sourcetype=foo earliest="4/20/2015:20:00:00" latest="4/20/2015:20:22:00"|stats count by whatever

If you want to know how to get Splunk to extract either the first or second timestamp in your log, you will need to decide which one. They seem to be indicating different timezones as the first one is 11pm and the 2nd one is 8pm. So pick one...

Those are settings that you want to apply in props.conf. In fact, if it is the first one... just add LINE_BREAKER=([\r\n]+)\d\/\d{2}\/\d{2} to props.conf under the stanza for this source/sourcetype and Splunk will grab the first one. if you want the second one, then you would add LINE_BREAKER and TIME_PREFIX which in this case is nice and easy, as it begins with a left square bracket.

All together it would look like this:

[sourcetypename]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d\/\d{2}\/\d{2}
TIME_PREFIX = \[
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

Motivator

Hello! Can i get your time format?

0 Karma

Explorer

Sample Log

4/20/15
11:47:00.000 PM
[04/20/2015][20:47:40.461][2020398512][s3214933/r21][Center realm][][][][][][206450682][][][][][][centerusushwswp222lprd][** Status: Authorized. ][]

0 Karma

Communicator

hi moiezuddin
can we have the time format pl

0 Karma