Getting Data In

Extract a non-strp timstamp across multiple pipe delimiters

jadamsplunk
Path Finder

Hi everyone,

Given an event like the following, is there a way to get this to successfully parse as _time at index time? I've tried including the pipe in my STRPTIME format but it does not work.

xxxx|yyyy|xxxx|yyyy|xxxx|yyyy|123000|111218|xxxx|yyyy

I would think that the following would work, but it has not:

TIME_FORMAT = %H%M%S|%m%d%y

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make sure you have sensible values for TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD.

0 Karma

FrankVl
Ultra Champion

^^what he says. Especially if some of those xxx, yyyy may also contain 6 digit numbers...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!