Getting Data In

Timestamp extraction for varying subseconds and time zones?

ankithreddy777
Contributor

How do you extract a timestamp from message having

event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC

event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST

where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc.

0 Karma

adonio
Ultra Champion

looks like splunk can handle it,

try below props.conf

[odd_timestamp]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9N, Timezone:%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=48

worked for me,
see screenshot below:

alt text

sudosplunk
Motivator

If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information.

http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...