Splunk Search

Multiple time logs in one timestamp

jsryu0247
Engager

Hello

Multiple time logs in one timestamp
example

19/01/24 10:28:51 [2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:212] ## Syslog Process.
[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:179] #### Syslog Message received
[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:220] ## Syslog L3IP Process

i need field

19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:212] ## Syslog Process.
19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:179] #### Syslog Message received
19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:220] ## Syslog L3IP Process

where is alter
$SPLUNK_HOME/etc/system/local/props.conf

thank you

Tags (1)
0 Karma

harsmarvania57
Ultra Champion

Hi,

If you want to extract timestamp from your logs (which has different formats) then you can create custom datetime.xml which will extract correct timestamp, please refer https://answers.splunk.com/answers/692340/how-can-we-set-time-format-in-propsconf-where-the.html

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...