Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- timestamp recognition in multi timestamp event
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all!
I have a problem with my log. Some events have only one timestamp, some have two - as in this example : http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configurepositionaltimestampextraction#Exampl...
How should I configure splunk to always match the latest timestamp in the event?
I could write regex, but I only can provide time PREFIX (TIME_PREFIX=...). If I write a TIME_PREFIX for two-timestamps-event - some events (with only one timestamp) will have incorrect time (time of indexing)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved my problem with using one, more complicated regex - with question mark match: ()?
TIME_PREFIX = (.*something123 (\[)?([^,]*, somethingother[^,]*,[^,]*, [^0-9]*)?)?
It was possible with my custom data.
@FritzWittwer
I haven't tried your solution, maybe it works.
I will keep the question open, for other ideas.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved my problem with using one, more complicated regex - with question mark match: ()?
TIME_PREFIX = (.*something123 (\[)?([^,]*, somethingother[^,]*,[^,]*, [^0-9]*)?)?
It was possible with my custom data.
@FritzWittwer
I haven't tried your solution, maybe it works.
I will keep the question open, for other ideas.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide some samples of your events (mask sensitive information) with both single and double timestamp values.?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would try it with a regexp with a two alternatives, one with a positive look ahead (?=…second time stamp regexp…)so it only matches if there is a second timestamp, did not try it out, but I think this could work.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
