Splunk Search

Timestamp extraction issue

asarolkar
Builder

Hi everyone,

I have the following log line which has two timestamps and we need to get the SECOND one.

Mar  4 18:50:02 ids1-ecojbs-p01 access_combined: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]




I tried using the wizard that Splunk provides and changed the setting in
Manager » Data inputs » Add data » A file or directory of files » Files & directories » Data preview, to the following

NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=/[%d/%b/%Y:%H:%M%S]/g




But this regex does not seem to be working out

Other potential log lines (where the second timestamp needs to be extracted), look like

Mar  4 18:50:02 ids1-ecojbs-p01 syslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]
Mar  4 18:50:02 ids1-ecojbs-p01 oslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]



Does anybody know what else ought to be configured in the wizard ?
Does it need a TIME_PREFIX ?
All input (especially by those who know regex) is welcome !

0 Karma
1 Solution

Ayn
Legend

Not sure what the leading / and trailing /g in your TIME_FORMAT is meant to be? It seems a bit like sed syntax...

The easiest thing would be to pick a TIME_PREFIX that makes Splunk jump to the correct timestamp. From there on I'm fairly sure it will recognize the timestamp format itself. Perhaps

TIME_PREFIX = - - \[

?

View solution in original post

Ayn
Legend

Not sure what the leading / and trailing /g in your TIME_FORMAT is meant to be? It seems a bit like sed syntax...

The easiest thing would be to pick a TIME_PREFIX that makes Splunk jump to the correct timestamp. From there on I'm fairly sure it will recognize the timestamp format itself. Perhaps

TIME_PREFIX = - - \[

?

asarolkar
Builder

That partly solved the problem.

I will pose my question once again (this time with more detail)

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...