Add new custom timestamp

[Eagleman]

Hello

I have a timestamp like Oct28-215189[ERROR]remoteHost: something

I tried to train splunk to recognize it but without luck.

could you give me some help ?

Thanks.

[dwaddle · Accepted solution]

You can configure Splunk to parse a time field specifically using props.conf

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.

[my_sourcetype]
TIME_PREFIX=^
TIME_FORMAT=%b%d-%H%M%S

That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.

[dwaddle]

yes, you should be able to extract the host using a regex ... docs cover it here - http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments .. if this doesn't get you going, I recommend you submit a new question specific to that. (Trying to handle follow-ons in comments can get difficult)

[Eagleman]

Thanks 😛 I did the same but propably it didn't work because i forgot the "^". Something more. Is there any way to extract the host ? (it's right after [ERROR]

[Eagleman]

a typo in the typo. where i say "type" i mean typo

[Eagleman]

Ups. you are right. 89 is a type. actually it is
Oct28-215129[ERROR]remoteHost: something

as you guess, it represents "MonDD-HHMMSS"

[dwaddle]

Some more information would be necessary to help with this. I assumed at first that this was "MonDD-HHMMSS" -- but 89 seconds did not make sense. In that example above, what date/time does it actually represent?