Getting Data In

How can i get a timestamp when time only shows time and date is randomly assigned on other lines?

Splunk Employee
Splunk Employee

Stumped here.

I have a logfile that looks like

18:21:05 (lmgrd) TIMESTAMP 8/16/2017
18:26:06 (ansyslmd) TIMESTAMP 8/16/2017
18:05:35 (ansyslmd) OUT: "hfss_solve"  
18:05:50 (ansyslmd) IN: "hfss_solve"  
18:20:32 (ansyslmd) OUT: "hfss_solve"  
18:20:32 (ansyslmd) IN: "hfss_solve"  
18:21:05 (lmgrd) TIMESTAMP 8/17/2017
18:26:06 (ansyslmd) TIMESTAMP 8/17/2017
19:28:24 (ansyslmd) OUT: "hfss_solve"  
19:28:37 (ansyslmd) IN: "hfss_solve"  
19:36:27 (ansyslmd) OUT: "hfss_solve"  
19:36:39 (ansyslmd) IN: "hfss_solve"  

The time part is correct on the left. And whenever a 'TIMESTAMP' line shows up id like to make that the correct 'date' portion of the timestamp used for the event in Splunk.

Can somebody tell me how to get this done. Im expecting ill need to setup a new sourcetype in Splunk for it. Can someone give me an outline of how to get this done here?

Thank you.

0 Karma

Splunk Employee
Splunk Employee

This likely requires configuring a custom datetime.xml for your sourcetype. For starters, take a look at this thread and see if it gets you on the right track. Not sure how it will behave for those events that are missing the date completely.
Let us know if you get stuck.

As an alternative, you could pre-process these log files on the source system and rewrite events to always contain a proper timestamp (using invalid_cause/unarchive_cmd)

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...