Getting Data In
Highlighted

TIME_PREFIX

Contributor

I have an autosys log with 4 columns (JobName|Start|End|Status) and would like to add them in splunk.

Check_Job|05/22/2012 02:09:17|05/22/2012 02:09:18|SUCCESS
Extract_Job|05/22/2012 03:09:17|05/22/2012 03:09:18|SUCCESS
Database_Job|05/22/2012 02:09:17||RUNNING

Two questions --

  1. How can I set the primary event time to be end time (column 3)? Can I use TIME_PREFIX=\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}
  2. Is it possible to set a secondary event time?
Tags (2)
0 Karma
Highlighted

Re: TIME_PREFIX

Splunk Employee
Splunk Employee

This link has an example that I included on your previous question. Splunk will only use one timestamp to represent the event time.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configurepositionaltimestampextraction

Once you get the regex ok for the TIMEPREFIX you will also need to set MAXTIMESTAMP_LOOKAHEAD. In this case i think set it to 50.

View solution in original post

0 Karma
Highlighted

Re: TIME_PREFIX

Contributor

The string length of the first column, job name, is between 3 - 60 characters. How can I be sure splunk won't pick start time as the event time knowing the timestamp format of start and end time is identical?

0 Karma
Highlighted

Re: TIME_PREFIX

Splunk Employee
Splunk Employee

Yes, that makes it more challenging. I think this is what you were looking for...manipulating the second date field anyways and leaving the current time stamp as is.

http://splunk-base.splunk.com/answers/4249/searching-mulitple-time-fields-within-a-record

Highlighted

Re: TIME_PREFIX

Contributor

This is not a bad solution. Is it possible to use relative time for the function strptime? (e.g. -30m or -2h)
The reason I am asking this is because I need to set up an alert and using a specific time won't be feasible.

0 Karma
Highlighted

Re: TIME_PREFIX

Contributor

Let me rephrase. Is there any function like this?

index=gops STATUS=closed | eval closedate=strptime(CLOSEDATE,"%m/%d/%y %H:%M") | where close_date>datediff (@now, -30m)

0 Karma
Highlighted

Re: TIME_PREFIX

Contributor

relative_time will do the magic. I am good. thanks!

0 Karma
Highlighted

Re: TIME_PREFIX

Splunk Employee
Splunk Employee

not sure if those will apply to anything other than the indexed _time for the event but i'm not sure exactly what you are referencing. You can caluculate the time now() in epoch time and do conversions i think...just not as elegant a solution. http://splunk-base.splunk.com/answers/117/how-do-i-get-the-current-time

0 Karma