Splunk Search

Redundant Time Values in Search

nowakdaw
Path Finder

Hello Everyone!

Thank you for your help. Our indexer currently has standard log4j logs as well as some custom logs. The issue occurs when we search for a log4j log (most of them are in this format) we have redundant time values. For example my search result will bring:

»17/10/2012 22:12:45.904[This is the left hand side time with the dropdown arrow] and then the event shows 22:12:45.904 2012-10-17 22:12:45,904.

Is there anyway to remove this redundancy?

Please let me know if this is unclear.

Thank you for your help.

0 Karma
1 Solution

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

View solution in original post

0 Karma

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...