Getting Data In

How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

New Member

Hello,

I have a problem when I want to extract the timestamp from an event in adding data to Splunk.

Here is a sample event :

<LOG>
  <DATE>12022012</DATE>
  <TIME>004459</TIME>
  <EventID>131</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>33</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000004</Keywords>
  <EventRecordID>7150639</EventRecordID>
  <Correlation />
</LOG>

I matched the timestamp prefix with this regex: \s*(?=\d{8}<\/DATE>\s*\d{6})
But I have a problem with the timestamp format because the Date and Time are not in the same line.

However, if the Date and Time were in the same line, Splunk can recognize the timestamp with this configuration:
Timestamp prefix : \s*(?=\d{8}<\/DATE>\s*\d{6})
Timestamp format : %d%m%Y%H%M%S

I really appreciate any help you can provide.

0 Karma

SplunkTrust
SplunkTrust

Hi voshka, This looks similar to another question here, the answer of which I believe you could adapt towards your needs : https://answers.splunk.com/answers/406376/how-do-i-edit-my-datetimexml-file-for-my-custom-da.html

Please let me know if this works out for you!

0 Karma

New Member

I have the same problem like Voshka. The link above is for logs that are in one line. I have almost the same log as Voshka and don't know how to get those date and time to be recognize?

Any ideas?

0 Karma

New Member

I think Splunk can only match the timestamp when the Date and Time were in the same line while on this event the date and time are in two different line,
How can i recognize the timestamp on this event log.

Regards

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!