Extract time stamp at different places in different logs in single source type

[thambisetty_bal]

Hi,

I have two different events in single source type and logs look like below,

1. Jan 15 09:50:18 xxxxxxxxxxxx ASM:"2017-01-15 09:50:17"

2. Jan 15 09:50:18 xxxxxxx notice tmm2[14778]: 01490521:5: 9e0c6145: Session statistics - bytes in: 1783, bytes out: 3585

3. Jan 15 09:50:18 xxxxxxxxxxx ASM:"2017-01-15 09:50:17"

I need to extract highlighted time stamps.

Note: all events in single source type but 1 & 3 events are same 2 event is different, below are my configurations:

[ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=AUTO
MAX_TIMESTAMP_LOOKAHEAD=128
disabled=false
TIME_FORMAT=%Y-%m-%d %T
TIME_PREFIX="

With the above configurations, I am not able to match time stamp from the second event specified above.

I can route events to multiple source types as they are two different event types coming on to single source type using props.conf and transforms.conf but I do not know how to apply time stamp extractions after creating new source types.

Please help me on this.

thanks in advance.

[gokadroid]

Since you already are aware of how to split the times if they happen to be in different sourcetypes, and exploring If you do not have to split the source types then one of the options might be to extract these times in SPL at run time using below syntax and assign back to _time:

| rex "\"(?<myTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\""
| eval _time=coalesce(strptime(myTime, "%Y-%m-%d %H:%M:%S"), _time)

Downside - This above piece will be required to be included in all the panels' query (or wherever you use the events)