Hi,
i have a table displaying log messages alone and their timestamp is same as they have only micro milliseconds difference in their occurrence, in the table the lo details are sorted according to the alphabetic order of the log details, i want it as it is in the log file.. How can i do this?
Please help
Thank you
Perhaps try changing the sort _time to...
| eval indextime=_indextime | sort indextime
This "may" work better than _time, if not you're just going to have to increase the timestamping on your logs as there is no guarantee it arrives in Splunk in the same order, thus Splunk doesn't know the original order in the log.
DISCLAIMER:
This obviously won't work if you have historical events or any other funny time related business going on.
Any other go?
it need to change the entire setpu of the product, i dont think it can be done :'(
The issue is that without finer detail in the timestamp there isn't really any way to ensure it appears as it does in the log. Can you increase the timestamping?
its not working :'(.. it is not a real time dashboard, i am uploading my logs and then searching on it..
Try
yoursearchhere
| sort _time
| table field1 field2 field3
However, I am not sure that I really undersand the question. It would be better to see your actual search.
nearly 15 logs with same timestamp.. it will be like
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer run started.
and the output table is like
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
Please help
and how does it appear in the log file?
this is my search lguinn
index=main source=file.txt|transaction startswith=START endswith=END maxevents=10000 |fields log_details |mvexpand log_details |join log_details [search index=main source=file.txt ]|table _time severity msg_code log_details |fields - _raw |sort _time
Yes, or perhaps to tell us how it appears in the log file so we actually understand how you want it to look 😛 Its pretty hard to replicate it without knowing! Although Lguinn is probably bang on the money with a sort by time