Splunk Search

timestamp lookahead

sarit_s
Communicator

Hello

i have this event for example:

$changeSystemTimeCmd 1533808153 -newTime 1533808153 -oldTime 1533808147

i need to set the timestamp to take the first number after the first string. in this can it is

$changeSystemTimeCmd

but it can be any string.
i tried with timestamp lookahead 30 but the problem is that i can't know what will be the length of this first string
how can i set timestamp lookahead regex to take the first number after first string ?

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

sarit_s
Communicator

i don't have indexer or HF
im running on all in one configuration so the sourcetype configuration located on props.conf in the app

it is working ! can you please explain why MAX_TIMESTAMP_LOOKAHEAD=10 ?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If you are running standalone splunk instance then also it will work. I have tested same config in Add Data in my lab splunk instance and it is working for me.

MAX_TIMESTAMP_LOOKAHEAD will count after TIME_PREFIX, in above config TIME_PREFIX regex cover till first whitespace so this $changeSystemTimeCmd is captured with TIME_PREFIX regex and after that you have 10 digit epoch time format so I have given 10 in MAX_TIMESTAMP_LOOKAHEAD

0 Karma

sarit_s
Communicator

thanks for your answer
it is working

i see it is also work without MAX_TIMESTAMP_LOOKAHEAD
the thing is that im afraid that the epoch time will be with more than 10 digits so if it is not necessary to limit i think it will be better

what do you think ?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If you do not set MAX_TIMESTAMP_LOOKAHEAD then it will take default value which is 128 character, I'll suggest to define MAX_TIMESTAMP_LOOKAHEAD with max length of your epoch time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...