Getting Data In

Can I have different timestamp formats using the same sourcetype?

rune_hellem
Contributor

Indexing a lot of SystemOut.log files from WebSphere I realize that all almost all log files uses the following time format

TIME_FORMAT = %m/%d/%y %H:%M:%S%3N %Z

But on some old servers the format is

TIME_FORMAT = %d/%m/%y %H:%M:%S%3N %Z

Is it possible for to use two formats for the same sourcetype? Or as an alternative can I create a "child sourcetype" with no other changes than the time_format?

Tags (2)
1 Solution

strive
Influencer

strive
Influencer

Yes it is possible by having your app specific datetime.xml

See this
http://answers.splunk.com/answers/11173/how-to-extact-multiple-timestamp-formats-for-syslog-input

Also, there is another website where they have some examples

http://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

rune_hellem
Contributor

For Windows users, worth noticing how to correctly define path to custom datetime.xml escaping backslashes. Took some time before I figured that one out (use double backslashes, it does not show here)

DATETIME_CONFIG = \\etc\\apps\\myapp\\local\\datetime.xml

0 Karma

tom_frotscher
Builder

I don't know if this works in your usecase. But you should be able to use a custom datetime.xml to solve this. Take a look at this: http://answers.splunk.com/answers/1807/2-different-timestamps-in-single-log

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...