Getting Data In

Time field extraction

pankajupadhyay
Path Finder

Hi,

How we can extract time from the log event and then index ?

As Splunk shows different time stamp on indexer but time stamp in log event are different.

 

Please help.

 

 

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pankajupadhyay,

probably Splunk cannot correctly recognize timestamps, so you have to give to Splunk some additional information, for a sourcetype:

  • TIME_FORMAT
  • TIME_PREFIX
  • MAX_TIMESTAMP_LOOKAHEAD
  • etc...

you can find more infos at https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Configuretimestamprecognition

If you share some sample of your data I could help you in this job.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...