Splunk Search

How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

astalv
New Member

Hi everyone!

I have a log with a strange format. In the filename, it is a full date and an hour of event and the minute:second are in the events inside the file, line by line.

For example:
File name: 16110810.log // it means yymmddHH

Lines:
10:01 xxx xxx xxx // it means MM:SS
10:02 yyy yyy yyy // it means MM:SS

Does anybody have an ideas how to extract time correctly other than in search time with eval?

I tried changing datetime.xml, but I have also hour stamp in a file name and it doesn't worked. Now I'm thinking about overwriting the _time field at index time, but not sure it is possible. Maybe any workaround? I have this data in a dedicated index and with its own sourcetype, of course.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi astalv,

I don't think you can extract the timestamps info correctly from both your source file and raw data at index time. Of course, you can use eval at search time to achieve this, as you already know.

You can overwrite event metadata at parsing time for specific sourcetypes, but this applies only to these metadata: host, source, sourcetype. An example below:

props.conf
[source::udp:514]
TRANSFORMS = custom_sourcetyper

transforms.conf
[custom_sourcetyper]
SOURCE_KEY = _raw
REGEX = Custom$
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::custom_log

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...