Getting Data In

Timestamp within event

splunklearner12
Path Finder

My log file contains events that sometimes contain timestamp strings of other actions.
For example, an event may have occurred at 24/05/19 07:58:12.000, but the event itself contains references to when a certain action was last conducted such as "last update on 5/20/2019 12:45:09.000." .
Is it possible to still interpret those values as time values so one could for example create a graph showing all historical updates?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible. First extract the string into a field then use strptime to convert it into a timestamp in epoch form. For example:

... | rex "last update on (?<lastUpdateStr>\S+\s\S+)" | eval lastUpdateTime=strptime(lastUpdateStr, "%m/%d/%Y %H:%M:%S.%3N") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible. First extract the string into a field then use strptime to convert it into a timestamp in epoch form. For example:

... | rex "last update on (?<lastUpdateStr>\S+\s\S+)" | eval lastUpdateTime=strptime(lastUpdateStr, "%m/%d/%Y %H:%M:%S.%3N") | ...
---
If this reply helps you, Karma would be appreciated.

splunklearner12
Path Finder

Excellent, thank you.

0 Karma

splunklearner12
Path Finder

sorry I though clicking the ^ did that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@splunklearner1234 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...