Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: timestamp recognition in multi timestamp event
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all!
I have a problem with my log. Some events have only one timestamp, some have two - as in this example : http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configurepositionaltimestampextraction#Exampl...
How should I configure splunk to always match the latest timestamp in the event?
I could write regex, but I only can provide time PREFIX (TIME_PREFIX=...). If I write a TIME_PREFIX for two-timestamps-event - some events (with only one timestamp) will have incorrect time (time of indexing)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved my problem with using one, more complicated regex - with question mark match: ()?
TIME_PREFIX = (.*something123 (\[)?([^,]*, somethingother[^,]*,[^,]*, [^0-9]*)?)?
It was possible with my custom data.
@FritzWittwer
I haven't tried your solution, maybe it works.
I will keep the question open, for other ideas.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved my problem with using one, more complicated regex - with question mark match: ()?
TIME_PREFIX = (.*something123 (\[)?([^,]*, somethingother[^,]*,[^,]*, [^0-9]*)?)?
It was possible with my custom data.
@FritzWittwer
I haven't tried your solution, maybe it works.
I will keep the question open, for other ideas.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide some samples of your events (mask sensitive information) with both single and double timestamp values.?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would try it with a regexp with a two alternatives, one with a positive look ahead (?=…second time stamp regexp…)so it only matches if there is a second timestamp, did not try it out, but I think this could work.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
