Getting Data In

Problem in displaying timestmap

Jananee_iNautix
Explorer

Hi ,

There is a requirement to change the time format from "04/04/14 13:11:37" to "Mon April 04 2014 13:11:37" .I tried the search query

index=fxr SNM* ASRRLUI | rex "^\S+\s(?<unique_field>\S+.\S+) ::"|transaction unique_field startswith="User logged off" endswith="Processing complete"| rex field=_raw "::\s(?<success_t>\S+\s\d+:\d+:\d+) :: User logged off"|eval Output_Timestamp=strptime(success_t,"%y/%m/%d %H:%M:%S")|eval Timestamp=strftime(Output_Timestamp,"%a %B %e %T %Y")|table success_t Output_Timestamp Timestamp unique_field

When the above search query is ran,the result is not getting displayed for some events.The #1 logs displays the timestamp whereas #2 doesnt displays the Timestamp.

The sample logs are as follows

1)
SNM4 ASRRLUI.43U :: 04/04/14 18:18:44 :: Processing complete
SNM4 ASRRLUI.43U :: 04/04/14 18:18:44 :: .
SNM4 ASRRLUI.43U :: 04/04/14 18:18:44 :: .
SNM4 ASRRLUI.43U :: 04/04/14 18:18:44 :: .
SNM4 ASRRLUI.43U :: 04/04/14 18:18:41 :: User logged off, Processing will begin
SNM4 ASRRLUI.43U :: 04/04/14 18:18:41 :: All received data will be processed as SAF for BTWA3FLR

2)SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 :: User logged off, Processing will begin
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 :: .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 :: .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 :: .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:28 :: Processing complete

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Jananee_iNautix,

take a closer look at this eval you're using:

eval Output_Timestamp=strptime(success_t,"%y/%m/%d %H:%M:%S")

you want to have month at second place in success_t value, but look at the second example you provided:

SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 :: User logged off, Processing will begin
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 ::  .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 ::  .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:24 ::  .
SNM4 BTWA3SLR.665F :: 05/14/14 18:24:28 :: Processing complete

what could be the 14th month of the year?
So, this is not the month but something different.

hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

you're welcome. please mark this answered by ticking the tick - thx

0 Karma

Jananee_iNautix
Explorer

Thanks....

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...