Extract Timestamp from logs that don't contain any Year reference

[lmeur]

I need to extract a timestamp from log files looking like that :

Feb 16 23:58:44 ...

As you can see, there is no reference to the year when the log was generated, so what I want to do is to extract day, month and hour reference and then mix it with current year from the splunk instance (or from the file last modification date).

Do you see a simple way to do this ?

Ludovic.

[Ant1D]

Hi,

When you run a search on these logs in your Splunk instance, you will see fields on the left-hand side that you can pick from. Select the last option that says All (number) fields. There should be a field named date_year that you can use.

[Ant1D]

My understanding is that you can either: Clean your index, edit the timestamps in the logs manually to include the year and then have these logs indexed in order to see the year in the timestamp as the value for the date_year field OR if this is not efficient then maybe you can achieve this in props.conf via a field extraction

[lmeur]

date_year allow me to get date field on search results but what I'm looking for is to change year on date_year field before indexing logs (during logs fields extraction)