Splunk Search

Add date to the timestamp of an event

oscargarcia
Path Finder

I have some events, that are indexed with strange dates...

17:56:58,442: htsxml2|c6d1956a-d611-47a5-97df-df0d31e1dbc7|32885|790667|483520|1|B|default|OK|65|3391
17:56:56,546: htsxml2|86bbb572-360d-4c12-8a18-0bd08ce0d7c0|17116|108051|130889|110|B|default|ERROR|-1|-1

Is there a way I can force the date to apply to the events contained in an specific file?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

If you use a filename that has a date in it, that date will be used (if there are no timestamps on your events).

For example, if you rename "dispo.log.P" to "dispo.20101020.log.P" those events should be indexed as occurring on Oct 20, 2010.

View solution in original post

0 Karma

woodcock
Esteemed Legend

As a supplement to both answers provided, the method to accomplish either is to use datetime.xml. In the former, you can setup 3 different rules to use, in the latter, you can tell Splunk to get the date from the filename and the time from the event.

0 Karma

sideview
SplunkTrust
SplunkTrust

Hmm. Rather than trying one really complex regex with lots of logic in it, did you try having 3 dead-simple regexes, with appropriate literals in it to match on like |B| vs |P| ? Sourcetypes can easily have more than one regex in them and 3 super-simple ones might perform better than one crazy-complicated one.

0 Karma

carasso
Splunk Employee
Splunk Employee

If you use a filename that has a date in it, that date will be used (if there are no timestamps on your events).

For example, if you rename "dispo.log.P" to "dispo.20101020.log.P" those events should be indexed as occurring on Oct 20, 2010.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...