How to extract multiple timeformats

[mwdbhyat]

Hi,

I have a series of devices coming into a syslog server. The format for the devices is as follows:

3 different formats:
mm/dd/hh:mm:ss
hh:mm:ss
d h

How do I configure timestamp formats for this if they are all the same sourcetype?

Thanks

[cpetterborg · Accepted solution]

See this article. It is probably all you need:

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

[mwdbhyat]

Thanks for that!

[woodcock]

Another here:
https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

[gcusello]

Hi mwdbhyat,
try using the default sourcetype recognition, you can test it downloading an example of each one of your logs and trying to ingest using web interface.
If this methid doesn't recognize your logs, you have to use different sourcetypes for each one.
Bye.
Giuseppe