Splunk Enterprise

How to extract timestamp without year in log?

ricotries
Communicator

I am trying to ingest a new log and unfortunately, it doesn't include year or time zone as part of the message.

The timestamp in the messages is in the following format:

 

Jun 30 01:02:03 <msg>

 

I wrote the following props.conf settings to extract the timestamp in the message:

 

[new_sourcetype]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 15
TIME_FORMAT = %b %d %H:%M:%S

 

 I see the following warnings under splunkd.log:

 

06-30-2022 14:05:59.555 -0600 WARN  DateParserVerbose [1556614 merging] - The TIME_FORMAT specified is matching timestamps (Tue Jun  6 17:43:20 2023) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=/path/to/log|host=UF01|new_sourcetype|230

 

 I'm confused where "(Tue Jun 6 17:43:20 2023)" is coming from because none of the logs have this string.

How do I approach this? I've thought about using transforms to write into the DEST_KEY "_time" but I read that any key starting with "_" is not indexed. This data is being received from a syslog server so I thought about modifying the data as it's being received. What are you recommendations?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...