Splunk Search

Redundant Time Values in Search

nowakdaw
Path Finder

Hello Everyone!

Thank you for your help. Our indexer currently has standard log4j logs as well as some custom logs. The issue occurs when we search for a log4j log (most of them are in this format) we have redundant time values. For example my search result will bring:

»17/10/2012 22:12:45.904[This is the left hand side time with the dropdown arrow] and then the event shows 22:12:45.904 2012-10-17 22:12:45,904.

Is there anyway to remove this redundancy?

Please let me know if this is unclear.

Thank you for your help.

0 Karma
1 Solution

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

View solution in original post

0 Karma

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...