Getting Data In

How to reformat timestamp in SYSLOG _raw

dokaas_2
Communicator

SYSLOG often sends the timestamp in the older format (e.g. Jul 11 14:23:32).  Unfortunately, that format does not have a year or timezone.  I know that Splunk has logic to 'figure' it out, but I need to have it reformatted to the following:

  YYYY-MM-DDTHH:mm:ss<GMT offset>

 

Is there a way to accomplish this with INGEST_EVAL or other method?  If so how is it done?  This should change the _raw event(that is, this is not a search time question).  Kind of like a mask.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dokaas_2,

I know two solutions:

a pre-parsing script that reformat your logs before Splunk ingest them.

the SEDCMD command.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...