Getting Data In

edit sourcetype settings?

bellaed
Path Finder

when i created my sourcetype my-log i selected default timestamp, later i found out that in some events with more than one line, certaing timestamps are there. and because of these timestamps those events are considered seperately.
the mistake i did is while creating sourcetype i didn't check out the option
Format with a checkbox to Specify timestampformat (strptime)ex; %Y-%m-%d
if i check that option and give the format of the timestamp which is always at the beginning of the event i am able to get the correct event formats, now how to change it as i already crreated sourcetypes and indexed files ..
Thanks Bella

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

For the sourcetype, edit props.conf. That won't affect already indexed events though, those need to be re-indexed.

View solution in original post

bellaed
Path Finder

As i already stated, there isn't anything before the time. Events should start with time.
Providing sample events for more clarification:
2012-10-24 15:39:48 : INFO :Num CPUs = 12
2012-10-24 15:39:48 : INFO :Pentium processor
2012-10-24 15:39:48 : INFO :nifaces = 5
2012-10-24 15:39:48 : INFO :iface name [lo]
2012-10-24 15:39:48 : INFO :checking..
license checking started
checking started at 24/10/2012 15:39:48
license field: [Product][blabla]
[certain numbers]:
license field: [Chicago Trading]
[key]:
license field: [Expiration-Date][never]
[key]:
license field: [License-Key][pdct key]

license parsed key [secretkey]

Time in the event in bold is considered as new event. Actually it is the continuation of previous event. How to skip reading second timestamp?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

For the sourcetype, edit props.conf. That won't affect already indexed events though, those need to be re-indexed.

martin_mueller
SplunkTrust
SplunkTrust

Based on the example from your non-answer, try this setting in props.conf under your sourcetype:

MAX_TIMESTAMP_LOOKAHEAD=20

Using only that, the remaining default values give me one event per row at first, and one long event starting with the "checking.." row.

smolcj
Builder

log starts with the timestamp but there are time in between which specifies some time point or earlier event happened time etc, splunk will read in between time and take those events as separate events
so give some prefixes for timestamps

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on your specific logs you may need to specify other timestamp configuration such as prefixes: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

0 Karma

bellaed
Path Finder

If this is the time specified in the log
2013-01-22 17:43:32
will TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf is enough?
But still not able to read the _time,even for the newly indexed logs..
it displays date correctly but time is default to 12:00:00.000 AM for every log events

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...