Getting Data In

How to extract unusual time information?

peterschloenske
Explorer

Hello,

I have events without a timestamp like epochtime or a format like 2020-02-03 18:41:00.
The needed information is kind of split up in the raw event. Raw events look like this sample:

sometext, date,20200203, some text, some text, time,184100, some text

Is it possible to create a useful timestamp extraction of out this during the data onboarding?

Best regards

0 Karma
1 Solution

PavelP
Motivator

you have to use custom datetime config which allows regexes between date and time:
https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

View solution in original post

13tsavage
Communicator

Are these coming from the same source or from different sources heading to the same index?

0 Karma

PavelP
Motivator

if I understand it correctly the date and the time are in the same log event, which implies it comes from the same source

0 Karma

13tsavage
Communicator

Okay then you need to figure out which format the date and timestamp mark the beginning of a new event. Then you can create custom event breakers for that specific data source.

Figure out which time stamp is shown in EVERY event that marks the beginning of that event, and I can help you with the rest.

0 Karma

PavelP
Motivator

you have to use custom datetime config which allows regexes between date and time:
https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

Get Updates on the Splunk Community!

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...