Getting Data In

If I have two time fields in an event, how do I configure Splunk to use the 2nd one as the timestamp?

Splunk Employee
Splunk Employee

My log file looks like below. I need Splunk to ID the time_of_stop time -- instead of the the time included with the date of stop prefixed with T

Should I use the field extractor to extract the T00:00:00? The time essentially is in two places and I want Splunk to grab the second one...

/_4mse-ku6q/1747516"> date of stop 2015-07-08T00:00:00 date of stop  time of stop18:20:00time of stopMCP1st district, Rockville
0 Karma
1 Solution

Revered Legend

Try something like this (props.conf on Indexer/HF)

[YourSourceType]
TIME_FORMAT=%Y-%m-%dT00:00:00 date of stop time of stop%H:%M:%S
TIME_PREFIX=date of stop\s+
MAX_TIMESTAMP_LOOKAHEAD=53
...Other settings....

View solution in original post

Revered Legend

Try something like this (props.conf on Indexer/HF)

[YourSourceType]
TIME_FORMAT=%Y-%m-%dT00:00:00 date of stop time of stop%H:%M:%S
TIME_PREFIX=date of stop\s+
MAX_TIMESTAMP_LOOKAHEAD=53
...Other settings....

View solution in original post

Splunk Employee
Splunk Employee

This worked great with some minor tweaks! THANKS

0 Karma

Community Manager
Community Manager

Hi @jpelletier

Glad you found a solution through @somesoni2 🙂 Don't forget to resolve yours posts by clicking "Accept" directly below the answer that best addressed your question. Also, be sure to upvote other users' answers/comments that helped you out to award them karma points. It's also good practice to share the final configuration with your minor tweaks so others are aware of the exact solution that worked for you. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!