Getting Data In

How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

New Member


I have a problem when I want to extract the timestamp from an event in adding data to Splunk.

Here is a sample event :

  <Correlation />

I matched the timestamp prefix with this regex: \s*(?=\d{8}<\/DATE>\s*\d{6})
But I have a problem with the timestamp format because the Date and Time are not in the same line.

However, if the Date and Time were in the same line, Splunk can recognize the timestamp with this configuration:
Timestamp prefix : \s*(?=\d{8}<\/DATE>\s*\d{6})
Timestamp format : %d%m%Y%H%M%S

I really appreciate any help you can provide.

0 Karma


Hi voshka, This looks similar to another question here, the answer of which I believe you could adapt towards your needs :

Please let me know if this works out for you!

0 Karma

New Member

I have the same problem like Voshka. The link above is for logs that are in one line. I have almost the same log as Voshka and don't know how to get those date and time to be recognize?

Any ideas?

0 Karma

New Member

I think Splunk can only match the timestamp when the Date and Time were in the same line while on this event the date and time are in two different line,
How can i recognize the timestamp on this event log.


0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!