Getting Data In

How can i get a timestamp when time only shows time and date is randomly assigned on other lines?

rvoninski_splun
Splunk Employee
Splunk Employee

Stumped here.

I have a logfile that looks like

18:21:05 (lmgrd) TIMESTAMP 8/16/2017
18:26:06 (ansyslmd) TIMESTAMP 8/16/2017
18:05:35 (ansyslmd) OUT: "hfss_solve" rv@rv.com  
18:05:50 (ansyslmd) IN: "hfss_solve" rv@rv.com  
18:20:32 (ansyslmd) OUT: "hfss_solve" rv@rv.com  
18:20:32 (ansyslmd) IN: "hfss_solve" rv@rv.com  
18:21:05 (lmgrd) TIMESTAMP 8/17/2017
18:26:06 (ansyslmd) TIMESTAMP 8/17/2017
19:28:24 (ansyslmd) OUT: "hfss_solve" rv@rv.com  
19:28:37 (ansyslmd) IN: "hfss_solve" rv@rv.com  
19:36:27 (ansyslmd) OUT: "hfss_solve" rv@rv.com  
19:36:39 (ansyslmd) IN: "hfss_solve" rv@rv.com  

The time part is correct on the left. And whenever a 'TIMESTAMP' line shows up id like to make that the correct 'date' portion of the timestamp used for the event in Splunk.

Can somebody tell me how to get this done. Im expecting ill need to setup a new sourcetype in Splunk for it. Can someone give me an outline of how to get this done here?

Thank you.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

This likely requires configuring a custom datetime.xml for your sourcetype. For starters, take a look at this thread and see if it gets you on the right track. Not sure how it will behave for those events that are missing the date completely.
Let us know if you get stuck.

As an alternative, you could pre-process these log files on the source system and rewrite events to always contain a proper timestamp (using invalid_cause/unarchive_cmd)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...