Archive

timestamp lookahead

Path Finder

Hello

i have this event for example:

$changeSystemTimeCmd 1533808153 -newTime 1533808153 -oldTime 1533808147

i need to set the timestamp to take the first number after the first string. in this can it is

$changeSystemTimeCmd

but it can be any string.
i tried with timestamp lookahead 30 but the problem is that i can't know what will be the length of this first string
how can i set timestamp lookahead regex to take the first number after first string ?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

View solution in original post

SplunkTrust
SplunkTrust

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

View solution in original post

Path Finder

i don't have indexer or HF
im running on all in one configuration so the sourcetype configuration located on props.conf in the app

it is working ! can you please explain why MAXTIMESTAMPLOOKAHEAD=10 ?

0 Karma

SplunkTrust
SplunkTrust

If you are running standalone splunk instance then also it will work. I have tested same config in Add Data in my lab splunk instance and it is working for me.

MAX_TIMESTAMP_LOOKAHEAD will count after TIME_PREFIX, in above config TIME_PREFIX regex cover till first whitespace so this $changeSystemTimeCmd is captured with TIMEPREFIX regex and after that you have 10 digit epoch time format so I have given 10 in `MAXTIMESTAMP_LOOKAHEAD`

0 Karma

Path Finder

thanks for your answer
it is working

i see it is also work without MAXTIMESTAMPLOOKAHEAD
the thing is that im afraid that the epoch time will be with more than 10 digits so if it is not necessary to limit i think it will be better

what do you think ?

0 Karma

SplunkTrust
SplunkTrust

If you do not set MAX_TIMESTAMP_LOOKAHEAD then it will take default value which is 128 character, I'll suggest to define MAX_TIMESTAMP_LOOKAHEAD with max length of your epoch time.

0 Karma