I have a timestamp like Oct28-215189[ERROR]remoteHost: something
I tried to train splunk to recognize it but without luck.
could you give me some help ?
Some more information would be necessary to help with this. I assumed at first that this was "MonDD-HHMMSS" -- but 89 seconds did not make sense. In that example above, what date/time does it actually represent?
Ups. you are right. 89 is a type. actually it is
as you guess, it represents "MonDD-HHMMSS"
You can configure Splunk to parse a time field specifically using props.conf
This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition
The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.
[my_sourcetype] TIME_PREFIX=^ TIME_FORMAT=%b%d-%H%M%S
That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.
Thanks 😛 I did the same but propably it didn't work because i forgot the "^". Something more. Is there any way to extract the host ? (it's right after [ERROR]
yes, you should be able to extract the host using a regex ... docs cover it here - http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments .. if this doesn't get you going, I recommend you submit a new question specific to that. (Trying to handle follow-ons in comments can get difficult)