Splunk Search

Different date format in same log

pero1234
Path Finder

How can I pars this log with different date format?

data.log:

2011.06.30 16:06:11 data data data data bla bla
30.06.2011. 16:06:10 data data data bla bla data
...
Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You can't use TIME_FORMAT in this example, because that assumes there is a single timestamp format within the file.

It's possible that both of these formats are in datetime.xml already, which would let Splunk parse them without help. If not, you could make a custom datetime.xml that has both of these formats in it. That should let the timestamp parser differentiate between the two and parse appropriately.

http://www.splunk.com/base/Documentation/4.2.2/Data/TrainSplunkToRecognizeATimestamp#Createacustomda...

View solution in original post

0 Karma

pero1234
Path Finder

I need include both date format. I need include everything in this log.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You can't use TIME_FORMAT in this example, because that assumes there is a single timestamp format within the file.

It's possible that both of these formats are in datetime.xml already, which would let Splunk parse them without help. If not, you could make a custom datetime.xml that has both of these formats in it. That should let the timestamp parser differentiate between the two and parse appropriately.

http://www.splunk.com/base/Documentation/4.2.2/Data/TrainSplunkToRecognizeATimestamp#Createacustomda...

0 Karma

pero1234
Path Finder

THX for help. It seems that splunk correctly recognize and separate events without define sourcetype.
I try to define sourcetype=datalog and in props.conf define just stanza name without any options and works!

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Could you edit your question to clarify what you'd like to see in terms of a date format? Which of the two formats here would you like to include/exclude?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...