I have an autosys log with 4 columns (JobName|Start|End|Status) and would like to add them in splunk.
Check_Job|05/22/2012 02:09:17|05/22/2012 02:09:18|SUCCESS Extract_Job|05/22/2012 03:09:17|05/22/2012 03:09:18|SUCCESS Database_Job|05/22/2012 02:09:17||RUNNING
Two questions --
This link has an example that I included on your previous question. Splunk will only use one timestamp to represent the event time.
Once you get the regex ok for the TIMEPREFIX you will also need to set MAXTIMESTAMP_LOOKAHEAD. In this case i think set it to 50.
The string length of the first column, job name, is between 3 - 60 characters. How can I be sure splunk won't pick start time as the event time knowing the timestamp format of start and end time is identical?
Yes, that makes it more challenging. I think this is what you were looking for...manipulating the second date field anyways and leaving the current time stamp as is.
This is not a bad solution. Is it possible to use relative time for the function strptime? (e.g. -30m or -2h)
The reason I am asking this is because I need to set up an alert and using a specific time won't be feasible.
Let me rephrase. Is there any function like this?
index=gops STATUS=closed | eval closedate=strptime(CLOSEDATE,"%m/%d/%y %H:%M") | where close_date>datediff (@now, -30m)
not sure if those will apply to anything other than the indexed _time for the event but i'm not sure exactly what you are referencing. You can caluculate the time now() in epoch time and do conversions i think...just not as elegant a solution. http://splunk-base.splunk.com/answers/117/how-do-i-get-the-current-time