Splunk Search

Different date format in same log

Path Finder

How can I pars this log with different date format?

data.log:

2011.06.30 16:06:11 data data data data bla bla
30.06.2011. 16:06:10 data data data bla bla data
...
Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can't use TIME_FORMAT in this example, because that assumes there is a single timestamp format within the file.

It's possible that both of these formats are in datetime.xml already, which would let Splunk parse them without help. If not, you could make a custom datetime.xml that has both of these formats in it. That should let the timestamp parser differentiate between the two and parse appropriately.

http://www.splunk.com/base/Documentation/4.2.2/Data/TrainSplunkToRecognizeATimestamp#Createacustomda...

View solution in original post

0 Karma

Path Finder

I need include both date format. I need include everything in this log.

0 Karma

SplunkTrust
SplunkTrust

You can't use TIME_FORMAT in this example, because that assumes there is a single timestamp format within the file.

It's possible that both of these formats are in datetime.xml already, which would let Splunk parse them without help. If not, you could make a custom datetime.xml that has both of these formats in it. That should let the timestamp parser differentiate between the two and parse appropriately.

http://www.splunk.com/base/Documentation/4.2.2/Data/TrainSplunkToRecognizeATimestamp#Createacustomda...

View solution in original post

0 Karma

Path Finder

THX for help. It seems that splunk correctly recognize and separate events without define sourcetype.
I try to define sourcetype=datalog and in props.conf define just stanza name without any options and works!

0 Karma

Splunk Employee
Splunk Employee

Could you edit your question to clarify what you'd like to see in terms of a date format? Which of the two formats here would you like to include/exclude?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!