Getting Data In

How to ingest only those lines from the log that start with "date/time"

mlevsh
Builder

We have logs , where first few lines needs to be omitted from ingesting.
We only need to on-board the events , that start with the date/time in the following format:
"%m/%d/%Y@%H:%M"

Appreciate all the ideas and suggestions.


Here is  the log example (there are also empty lines
before first "#-----------------------------------------" and
after last "#-----------------------------------------"):



      #-----------------------------------------
      #DATE CREATED:  11/02/2021@04:16
      #SUBJECT:       REPORT ON THE GENERAL STATUS OF AUTOSYS JOBS
      #ENVIRONMENT:   CBA
      #-----------------------------------------

      11/02/2021@04:16,CBA,OTHER,CBA_CLIENT_REPORT_BOX,OI
      11/02/2021@04:16,CBA,OTHER,CBA_copy_file_job,OI
      11/02/2021@04:16,CBA,OTHER,CBA_ABC_SCHEDULER_BOX,OI
      11/02/2021@04:16,CBA,OTHER,CBA_ABC_REPORT_BOX,OI

Labels (2)
Tags (1)
0 Karma

badrinath_itrs
Communicator

@mlevsh , This question is already answered in the past. 

Can you please look into below link and see that helps. 

Ignoring-any-data-record-that-begins-with-a-quot-quot-character

You can do this with props and Transforms as mentioned in the above post. 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...