This is my example log file:
-- Daily Prod Started 7/28/2022 12:36:05 PM 0.762 sec
-- BegMo='06/01/2022' 7/28/2022 12:36:05 PM 0.049 sec
-- BegDate='06/01/2022' 7/28/2022 12:36:05 PM 0 sec
-- EndDate='07/28/2022' 7/28/2022 12:36:05 PM 0 sec
-- EndMidNight='07/29/2022' 7/28/2022 12:36:05 PM 0 sec
-- Data Collection Start=7/28/2022 12:36:05 PM 7/28/2022 12:36:05 PM 0 sec
How do I pick up the timestamp on lines 2-5 - where there is a date with quotes, and lines 1 and 6, where there is not?
Hi @jmgilpin,
There's only one thing that I don't understand: are you speaking of the event timestamp, or about the extraction of other fields tin date-time format?
In the first case, as @PickleRick said, you should use TIME_PREFIX and TIME_FORMAT to identify the correct timestamp.
In the second case, you should use the first as timestamp and extract the others as fields using regexes.
Ciao.
Giuseppe
My intent was to parse the timestamp of the event - but I do not see a common set of chars to use as the prefix. The timestamp in quotes is the value of a variable.
Fortunately, I was able to use current timestamp, so I am able to ingest the log files as they are created.
As this is a vendor log - and they are not to keen on changing the log format, current timestamp is workable.
thanks all!
James
Hi @jmgilpin,
if the one you shared is a sample of your logs, you could use as TIME_PREFIX the first datetime yu have:
TIME_PREFIX = ^--\s+Daily Prod\s+Started\s+
TIME_FORMAT = %m/%d/%Y %I:%M:%S %p
Ciao.
Giuseppe
:
Interesting, I was treating each line as a separate entry, but treating the group of items as a single entry... that would work... will gave that a try and get back to you.
Thanks!
Hi @jmgilpin,
good for you,
tell me if I can help you more, otherwise, please, accept one answer for the other people of Community.
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated by all the Contributors 😉
Set long enough MAX_TIMESTAMP_LOOKAHEAD and define proper TIME_PREFIX which will account for all event versions.