Getting Data In
Highlighted

Add new custom timestamp

New Member

Hello

I have a timestamp like Oct28-215189[ERROR]remoteHost: something

I tried to train splunk to recognize it but without luck.

could you give me some help ?

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Add new custom timestamp

SplunkTrust
SplunkTrust

Some more information would be necessary to help with this. I assumed at first that this was "MonDD-HHMMSS" -- but 89 seconds did not make sense. In that example above, what date/time does it actually represent?

0 Karma
Highlighted

Re: Add new custom timestamp

New Member

Ups. you are right. 89 is a type. actually it is
Oct28-215129[ERROR]remoteHost: something

as you guess, it represents "MonDD-HHMMSS"

0 Karma
Highlighted

Re: Add new custom timestamp

New Member

a typo in the typo. where i say "type" i mean typo

0 Karma
Highlighted

Re: Add new custom timestamp

SplunkTrust
SplunkTrust

You can configure Splunk to parse a time field specifically using props.conf

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.

[my_sourcetype]
TIME_PREFIX=^
TIME_FORMAT=%b%d-%H%M%S

That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.

View solution in original post

Highlighted

Re: Add new custom timestamp

New Member

Thanks 😛 I did the same but propably it didn't work because i forgot the "^". Something more. Is there any way to extract the host ? (it's right after [ERROR]

0 Karma
Highlighted

Re: Add new custom timestamp

SplunkTrust
SplunkTrust

yes, you should be able to extract the host using a regex ... docs cover it here - http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments .. if this doesn't get you going, I recommend you submit a new question specific to that. (Trying to handle follow-ons in comments can get difficult)

0 Karma