I have imported a file which has more than one time and date field, splunk is using one of them, however I would like to specify the other time field in the file?
I have been playing around with splunk for a while and have not found an easy way to do it?
Any help would be appreciated.
Assuming your alternate timestamp is already being extracted into a field named
EventTime, then you can use
eval to replace the original value of the
| eval _time=EventTime
If you don't have a field extraction set up, you can also use
rex to extract the alternate timestamp from
Be aware that your timestamp needs to be a valid Unix epoch time to work. If your data shows the time in text format, you'll need to convert it first. The exact parameters will vary based on the format. For a date of the form 2010-10-26 14:50:58, you would need:
| eval _time=strptime(EventTime, "%Y-%m-%d %H:%M:%S")
If you are always going to want this timestamp instead of the one that Splunk is extracting automatically, take a look at http://www.splunk.com/base/Documentation/4.1.5/Admin/ConfigurePositionalTimestampExtraction for information on how to modify Splunk's default timestamp recognition.
Thanks for the quick reply.
I have tried the following as a search:
source="c:\Log.log" | rex field=_raw "EventTime: (?
and also I have tried:
source="c:\ThreatLog.log" | eval _time="EventTime"
When I run either of these it says there are 21 things found but does not display anything on the time line and does not list anything below, any ideas?
The first line of the log file is:
2010-10-27 11:45:11 syslogsvc INFO: EventID=1; EventTime=2010-10-26 14:50:58; and some other stuff....
I would like to use EventTime as _time
Also, sorry I didn’t realise it would takeout the formatting!
The date is being extracted in text form, but Splunk needs it in unix epoch time. You will need to convert it - see edits above.