Getting Data In

Timestamp within event

splunklearner12
Path Finder

My log file contains events that sometimes contain timestamp strings of other actions.
For example, an event may have occurred at 24/05/19 07:58:12.000, but the event itself contains references to when a certain action was last conducted such as "last update on 5/20/2019 12:45:09.000." .
Is it possible to still interpret those values as time values so one could for example create a graph showing all historical updates?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible. First extract the string into a field then use strptime to convert it into a timestamp in epoch form. For example:

... | rex "last update on (?<lastUpdateStr>\S+\s\S+)" | eval lastUpdateTime=strptime(lastUpdateStr, "%m/%d/%Y %H:%M:%S.%3N") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible. First extract the string into a field then use strptime to convert it into a timestamp in epoch form. For example:

... | rex "last update on (?<lastUpdateStr>\S+\s\S+)" | eval lastUpdateTime=strptime(lastUpdateStr, "%m/%d/%Y %H:%M:%S.%3N") | ...
---
If this reply helps you, Karma would be appreciated.

splunklearner12
Path Finder

Excellent, thank you.

0 Karma

splunklearner12
Path Finder

sorry I though clicking the ^ did that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@splunklearner1234 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...