Getting Data In

How do you add a timestamp onto a log that has a second counter in the log?

robertlynch2020
Motivator

Hi,

I have a log that has a second counter inside it, 1 2...11... 3601...etc .

So data i have
1 Data XXYXX
2 Data XXYXX
5 Data XXYXX
11 Data XXYXX
3601 Date XXYY
etc...

The issues is the log can be given to Splunk on one GO, so it might get 20K links in the same few seconds So I can't use INDEX TIME (As i think it will put all the events into the same few seconds, i need the data to be spread using the seconds in the file)

So i need it to say 3600 seconds is 1 hour and give each event a different time stamp pending on the second counter.....

ALSO...to make it more complex :):):).

I don't want the time to go forward into the future — i would like it to start at the end and go backwards — or, set a negative 2 weeks as "0" and go forward...something like that... [Basally i don't want future events from now()]

What i want Splunk to see for TIMESTAMP (Assuming we go back to start of month or something like that)

01/11/2018 12:00:01 1 Data XXYXX
01/11/2018 12:00:02 2 Data XXYXX
01/11/2018 12:00:05 5 Data XXYXX
01/11/2018 12:00:11 11 Data XXYXX
01/11/2018 13:00:02 3601 Date XXYY

Any help would be super super stuff thanks

Cheers in Advance 🙂
Robbie

0 Karma

adonio
Ultra Champion

i think that for index time, youll have to use the datetime.xml to achieve your goals.
you can do it easily at search time, example:

index=<your_index> sourcetype=<your_sourcetype>
| rex field=_raw "(?<seconds_counter>\d+)"
| eval _time = _time + seconds_counter
| more stats and evals to complete your search

hope it helps

0 Karma

robertlynch2020
Motivator

Hi.

In fact i need this to add to a datamodel, so i need to do it on index time if possible.

0 Karma

adonio
Ultra Champion

interesting,
data models are search results ... why not create an eval field?

0 Karma

robertlynch2020
Motivator

HI

This is what we did thanks.
In the datamodel we put in if(isnull(GC_TIMESTAMP),_time-2592000+relative_time,_time) .

So relative_time is the seconds and if no time stamp is there we go back 90 days and start from there.

cheers

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...