Splunk Search

extracting timestamp from multiple timestamp

Path Finder


I have the following event with multiple time stamp

Feb 18 2015 16:20:00:456 host=127.XX.XXX.XX 21:20:00:456 XXXX

I need splunk to recognize timstamp from :

the following onwards

Feb 18 2015 16:20:00:456 host=127.XX.XXX.XX "21:20:00:456 XXXX"

the ones marked in " XXX"

What entry do i need to put in props.conf to achieve this.

Please let me know


Tags (1)
0 Karma

Esteemed Legend

Use this:

TIME_PREFIX = .*?host=\d+\.\d+\.\d+\.\d+\s+\"
0 Karma


Hi @mmohiuddin

Just to clarify for people who can help you, you want to extract the timestamp 21:20:00:456?

0 Karma

Path Finder

yes I want to extract the timestamp 21:20:00:456

0 Karma

Path Finder

This is the actual log event:

Feb 19 09:00:55 Feb 19 14:00:56 LDC-N26-SSLVPN4 AN_SQUID_LOG 1424354456.021 1 TCP_MISS/200 1670 GET /myaccess/logout.gif - DIRECT/ -

It is coming from syslog event.

I need splunk to extract timestamp from

Feb 19 14:00:56 LDC-N26-SSLVPN4


This is what I have entered in props.conf on indexer. Source is udp:514

TIME_PREFIX = \w+\s+\d+\s+\d+:\d+:\d+\s+\d+.\d+.\d+.\d+\s+

But even after doing that and restarting indexer, I am still not able to extract the required timestamp

Feb 19 14:00:56 LDC-N26-SSLVPN4

Please let me know what I am missing here

0 Karma


If time is ALWAYS exactly 5 hours off, the just make a timezone shift off the first time in the event. That would be the easiest thing to do.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...