Getting Data In

How to limit date timestamp parsing view?

gbowden_pheaa
Path Finder

I have a proxy server that is double date stamping events. This is not normally an issue, but I ran into a hydridization of these dates when the 2 date stamps differ:

  Jul 27 23:59:59 name01 name01.coname.dom: <Mon, 28 Jul 2014 00:00:00,EDT> xxxpayloadxxx

Splunk date-stamped this event as 7/28/2014 23:59:59. We are utilizing Splunk's default time stamp parsing for this source.

I want Splunk to stop looking for a date after 16 characters. My understanding for the max_timestamp_lookahead in props.conf tells Splunk where to start, not stop.

Any guidance is appreciated. Thanks

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can specify this:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 16

The prefix tells it where to start, and the lookahead where to stop. Additionally, you could specify an appropriate TIME_FORMAT.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can specify this:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 16

The prefix tells it where to start, and the lookahead where to stop. Additionally, you could specify an appropriate TIME_FORMAT.

gbowden_pheaa
Path Finder

Awesome - thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...