Getting Data In

multikv row timestamp extraction

kubowler99
New Member

I'm trying to figure out the best way to extract a time stamp (not date) from a row when using multikv.

Here's the raw data:

" AIX Net Activity for Sunday, January 1, 2012 (00:00-00:00) (1) es2p375p"

         CPU            KB       PKTS            PKT ERRS          
  ------------------ --------- --------- ------------------------- 
  %I  %K %U %W logc   I    O    I    O   In errs O errs Collisions 
  --- -- -- -- ----- ---- ---- ---- ---- ------- ------ ---------- 

20:00 95 4 1 0 0.40 0 0 * * * * *

18:00 95 4 1 0 0.38 0 0 * * * * *

16:00 95 4 1 0 0.38 0 0 * * * * *

14:00 94 4 1 0 0.42 0 0 * * * * *

12:00 95 4 1 0 0.41 0 0 * * * * *

10:00 95 4 1 0 0.40 0 0 * * * * *

08:00 95 4 1 0 0.41 0 0 * * * * *

06:00 86 4 5 5 0.73 0 0 * * * * *

04:00 85 5 7 3 0.95 0 0 * * * * *

02:00 93 5 1 1 0.51 0 0 * * * * *

00:24 95 3 1 0 0.36 0 0 * * * * *

--- -- -- -- ----- ---- ---- ---- ---- ------- ------ ----------
SUM: 0 0

AVG: 93 4 2 1 0.49 0 0

I've already configured the multikv.conf and props.conf files to parse the log and extract the fields properly (there are multiple tables in a single log file, one table for each day).

Splunk see's each table as a different day, but the timestamp for each event/row is always 00:00, as opposed to the time in the first field of the event row. For example, the row

20:00 95 4 1 0 0.40 0 0 * * * * *

Will have a date/time stamp of January 1, 2012 00:00, instead of January 1, 2012 20:00.

Any ideas on the best way to solve this? All suggestions are welcome. Thanks!

Tags (2)
0 Karma

lguinn2
Legend

First, assume that the first column is extracted into a field called "T". You can calculate the full timestamp as

<yoursearch> | multikv <params> | eval timestamp = _time + strptime(T, "%H:%M") | 
fieldformat timestamp = strftime(timestamp,"%x %X") | ...

Now you can use the new field called "timestamp" instead of _time in the remainder of your command...

kubowler99
New Member

Yeah - looks like the strptime(T, "%H:%M") is being evaluated with a Month, Day, Year, in addition to the Hour:Minute, which is hosing the epochtime. For example, when I only have 'eval timestamp = strptime(T, "%H:%M"), and T="19:00", timestamp returns as February 26, 2012 19:00. This would explain why your solution returns the March 02, 2054 01:00 timestamp.

Back to the drawing board, I guess. Still working on it.

0 Karma

kubowler99
New Member

Thanks, again.

  • I don't think the above is completely accurate, as I modified the strftime to (timestamp, "%B %d, %Y %H:%M") to get the full date, and both the day and time are off. Instead of January 5, 2012 19:00, it returns March 02, 2054 01:00.

I'm assuming it's the eval statement that may need to be modified, but not sure.

0 Karma

kubowler99
New Member

Thanks, lguinn. Will give it a shot and post results.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...