Splunk Search

Redundant Time Values in Search

nowakdaw
Path Finder

Hello Everyone!

Thank you for your help. Our indexer currently has standard log4j logs as well as some custom logs. The issue occurs when we search for a log4j log (most of them are in this format) we have redundant time values. For example my search result will bring:

»17/10/2012 22:12:45.904[This is the left hand side time with the dropdown arrow] and then the event shows 22:12:45.904 2012-10-17 22:12:45,904.

Is there anyway to remove this redundancy?

Please let me know if this is unclear.

Thank you for your help.

0 Karma
1 Solution

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

View solution in original post

0 Karma

nowakdaw
Path Finder

Hello All,

I have figured this out. For all those interested:

I used SEDCMD to accomplish this, giving a regex to match the time from the log4j entry and removing this. I verfied that the timing is correcting with the entry removed. It seems that this SED removal is done after splunk indexes the data.

This page was very usefulfto me. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

Thank you all!

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!