Getting Data In

Extract time stamp at different places in different logs in single source type

thambisetty_bal
Path Finder

Hi,

I have two different events in single source type and logs look like below,

  1. Jan 15 09:50:18 xxxxxxxxxxxx ASM:"2017-01-15 09:50:17"

  2. Jan 15 09:50:18 xxxxxxx notice tmm2[14778]: 01490521:5: 9e0c6145: Session statistics - bytes in: 1783, bytes out: 3585

  3. Jan 15 09:50:18 xxxxxxxxxxx ASM:"2017-01-15 09:50:17"

I need to extract highlighted time stamps.

Note: all events in single source type but 1 & 3 events are same 2 event is different, below are my configurations:

[ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=AUTO
MAX_TIMESTAMP_LOOKAHEAD=128
disabled=false
TIME_FORMAT=%Y-%m-%d %T
TIME_PREFIX="

With the above configurations, I am not able to match time stamp from the second event specified above.

I can route events to multiple source types as they are two different event types coming on to single source type using props.conf and transforms.conf but I do not know how to apply time stamp extractions after creating new source types.

Please help me on this.

thanks in advance.

Tags (2)
0 Karma

gokadroid
Motivator

Since you already are aware of how to split the times if they happen to be in different sourcetypes, and exploring If you do not have to split the source types then one of the options might be to extract these times in SPL at run time using below syntax and assign back to _time:

| rex "\"(?<myTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\""
| eval _time=coalesce(strptime(myTime, "%Y-%m-%d %H:%M:%S"), _time)

Downside - This above piece will be required to be included in all the panels' query (or wherever you use the events)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...