Getting Data In

How to extract multiple timeformats

mwdbhyat
Builder

Hi,

I have a series of devices coming into a syslog server. The format for the devices is as follows:

3 different formats:
mm/dd/hh:mm:ss
hh:mm:ss
d h

How do I configure timestamp formats for this if they are all the same sourcetype?

Thanks

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust
0 Karma

cpetterborg
SplunkTrust
SplunkTrust
0 Karma

mwdbhyat
Builder

Thanks for that!

0 Karma

woodcock
Esteemed Legend
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mwdbhyat,
try using the default sourcetype recognition, you can test it downloading an example of each one of your logs and trying to ingest using web interface.
If this methid doesn't recognize your logs, you have to use different sourcetypes for each one.
Bye.
Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!