Getting Data In

Log file - small subset of entries lacks timestamp - how to fix at index time?

nem
New Member

Hey guys,

I'm having a bit of a hard time with a few events in our game's log files. I would've changed the logging format, but it is part of the game engine which means I cannot just change it.

Log file open, 05/09/15 23:24:39
LogInit:Display: Running engine for game: MyGame
LogInit: Version: 4.7.6-0+++depot+UE4-Releases+4.7
LogInit: API Version: 0
LogInit: Compiled (64-bit): May  5 2015 00:09:28
LogInit: Compiled with Visual C++: 18.00.31101.00
LogInit: Build Configuration: Development
LogInit: Branch Name: ++depot+UE4-Releases+4.7
LogInit: Command line:  
LogInit: Base directory: W:/UE4.7.X/UnrealEngine/Engine/Binaries/Win64/
LogInit: Rocket: 0
[2015.05.09-21.24.39:186][  0]LogTaskGraph: Started task graph with 3 named threads and 6 total threads.
[2015.05.09-21.24.39:394][  0]LogOnline:Display: STEAM: Loading Steam SDK 1.30
[2015.05.09-21.24.39:396][  0]LogOnline:Warning: STEAM: Steam API disabled!
[2015.05.09-21.24.39:396][  0]LogOnline:Display: STEAM: OnlineSubsystemSteam::Shutdown()
[2015.05.09-21.24.39:397][  0]LogOnline:Warning: Unable to create OnlineSubsystem module Steam
[-- rest of the output omitted --]

Ideally all these lines without a timestamp should receive the timestamp from the first line. What's the proper way of doing this?
It would also be okay if all events without timestamp were to be indexed as a multiline events, but right now the game's build date in line 5 is being interpreted as event timestamp and prevents splunk from grouping the events without timestamp together.

0 Karma

woodcock
Esteemed Legend

Use this in props.conf:

TIME_PREFIX = \[
TIME_FORMAT = %Y\.%m\.%d-%H\.%M\.%S:%3N
MAX_TIMESTAMP_LOOKAHEAD = 23

Each event that does not have a timestamp will be given the timestamp of the previous event.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...