Getting Data In

What should the sourcetype setting be for my sample log in order for Splunk to parse the timestamp?

splgeek
Explorer
<?xml version="1.0"?><Transmission xmlns="http://xxx.oracle.com/apps/xxx"><TransmissionHeader><Version>6.3.7</Version><TransmissionCreateDt><GLogDate>20161115035429</GLogDate>

When i add a sample log file, Splunk is unable to parse the timestamp. What should be the sourcetype setting so it can parse the timestamp correctly?

0 Karma

somesoni2
Revered Legend

You need to setup your custom sourcetype with following

TIME_PREFIX = \<GLogDate\>
TIME_FORMAT = %Y%m%d%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 14
0 Karma
Get Updates on the Splunk Community!

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...