Timestamp separeted by many field/character

[emaccaferri]

Hi!
I'm trying to extract a timestamp from a log like

"0123456" "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00"

(letters' number is undefined)

By default Splunk recognize all "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00" as a timestamp.

I tried to use %d/%m/%Y\D+\d"%H:%M inside the manager but it doesn't work.
Any idea?

[bmacias84]

Another ideas would be to would be to overide the MetaData using a transform. How familar are you with transforms.

[bmacias84]

what does your props.conf file for the sourcetype look like? MAX_TIMESTAMP_LOOKHEAD is 150 char, but you event doesnt pass that limit.

[grijhwani]

This should be along the lines you want, if I understand the question correctly:

{search} | rex "(?<fdate>\d{2}/\d{2}/\d{4}).*(?<ftime>\d{2}:\d{2})" | eval dateandtime=fdate." ".ftime | table dateandtime

[grijhwani]

So are you trying to say that - from your example data - you would want to extract the final value "01/02/2000 12:00"?