Splunk Enterprise

How to parse time in a flat datafile in ASCII with COBOL copybook

kunadi
New Member

Hi,
I have a dataset of ASCII flat file with events for every line. And I also have the COBOL copybook of this dataset.
example:

data:
0210160209230003BCA2

and the copybook:
02 RECORD-TYPE PIC X(04).
02 TRAN-DAT.
04 yy PIC X(02).
04 MM PIC X(02).
04 DD PIC X(02).
02 TRAN-TIM.
04 HH PIC X(02).
04 MM PIC X(02).
04 SS PIC X(02).
02 TERM-FIID PIC X(04).

How can I parse the time whose format is YYMMDDhhmmss?

Thanks

Tags (1)
0 Karma

davebrooking
Contributor

Hi

You probably need to make use of the Advanced Timestamp settings. You can try it out from the Add Data screen, select 'upload', select the file you want to index, and select Next.

In the Set Sourcetype panel, expand the Timestamp field on the left and select Advanced. Here you can set some attributes to tell Splunk where the timestamp field is located in your event. For your event you need to tell Splunk the Timestamp format and the Timestamp prefix (these are explained in the Splunk Enterprise documentation here)

For 'Timestamp format' try the strptime() format string %y%m%d%H%M%S
For 'Timestamp prefix' try the regex to skip the first 4 characters \w{4}

You could also enter 16 in the 'Lookahead' field, so Splunk will only consider characters in positions 5-16 as the timestamp.

Dave

kunadi
New Member

it works!
Thanks a lot Dave!

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...