How to parse time in a flat datafile in ASCII with COBOL copybook

[kunadi]

Hi,
I have a dataset of ASCII flat file with events for every line. And I also have the COBOL copybook of this dataset.
example:

data:
0210160209230003BCA2

and the copybook:
02 RECORD-TYPE PIC X(04).
02 TRAN-DAT.
04 yy PIC X(02).
04 MM PIC X(02).
04 DD PIC X(02).
02 TRAN-TIM.
04 HH PIC X(02).
04 MM PIC X(02).
04 SS PIC X(02).
02 TERM-FIID PIC X(04).

How can I parse the time whose format is YYMMDDhhmmss?

Thanks

[davebrooking]

Hi

You probably need to make use of the Advanced Timestamp settings. You can try it out from the Add Data screen, select 'upload', select the file you want to index, and select Next.

In the Set Sourcetype panel, expand the Timestamp field on the left and select Advanced. Here you can set some attributes to tell Splunk where the timestamp field is located in your event. For your event you need to tell Splunk the Timestamp format and the Timestamp prefix (these are explained in the Splunk Enterprise documentation here)

For 'Timestamp format' try the strptime() format string %y%m%d%H%M%S
For 'Timestamp prefix' try the regex to skip the first 4 characters \w{4}

You could also enter 16 in the 'Lookahead' field, so Splunk will only consider characters in positions 5-16 as the timestamp.

Dave

[kunadi]

it works!
Thanks a lot Dave!