Getting Data In

Extract a non-strp timstamp across multiple pipe delimiters

Path Finder

Hi everyone,

Given an event like the following, is there a way to get this to successfully parse as _time at index time? I've tried including the pipe in my STRPTIME format but it does not work.


I would think that the following would work, but it has not:

TIME_FORMAT = %H%M%S|%m%d%y

0 Karma


Make sure you have sensible values for TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD.

0 Karma

Ultra Champion

^^what he says. Especially if some of those xxx, yyyy may also contain 6 digit numbers...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...