Splunk Search

Timestamp extraction issue

asarolkar
Builder

Hi everyone,

I have the following log line which has two timestamps and we need to get the SECOND one.

Mar  4 18:50:02 ids1-ecojbs-p01 access_combined: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]




I tried using the wizard that Splunk provides and changed the setting in
Manager » Data inputs » Add data » A file or directory of files » Files & directories » Data preview, to the following

NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=/[%d/%b/%Y:%H:%M%S]/g




But this regex does not seem to be working out

Other potential log lines (where the second timestamp needs to be extracted), look like

Mar  4 18:50:02 ids1-ecojbs-p01 syslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]
Mar  4 18:50:02 ids1-ecojbs-p01 oslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]



Does anybody know what else ought to be configured in the wizard ?
Does it need a TIME_PREFIX ?
All input (especially by those who know regex) is welcome !

0 Karma
1 Solution

Ayn
Legend

Not sure what the leading / and trailing /g in your TIME_FORMAT is meant to be? It seems a bit like sed syntax...

The easiest thing would be to pick a TIME_PREFIX that makes Splunk jump to the correct timestamp. From there on I'm fairly sure it will recognize the timestamp format itself. Perhaps

TIME_PREFIX = - - \[

?

View solution in original post

Ayn
Legend

Not sure what the leading / and trailing /g in your TIME_FORMAT is meant to be? It seems a bit like sed syntax...

The easiest thing would be to pick a TIME_PREFIX that makes Splunk jump to the correct timestamp. From there on I'm fairly sure it will recognize the timestamp format itself. Perhaps

TIME_PREFIX = - - \[

?

asarolkar
Builder

That partly solved the problem.

I will pose my question once again (this time with more detail)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...