Splunk Search

extracting timestamp from multiple timestamp

Path Finder


I have the following event with multiple time stamp

Feb 18 2015 16:20:00:456 host=127.XX.XXX.XX 21:20:00:456 XXXX

I need splunk to recognize timstamp from :

the following onwards

Feb 18 2015 16:20:00:456 host=127.XX.XXX.XX "21:20:00:456 XXXX"

the ones marked in " XXX"

What entry do i need to put in props.conf to achieve this.

Please let me know


Tags (1)
0 Karma

Esteemed Legend

Use this:

TIME_PREFIX = .*?host=\d+\.\d+\.\d+\.\d+\s+\"
0 Karma


Hi @mmohiuddin

Just to clarify for people who can help you, you want to extract the timestamp 21:20:00:456?

0 Karma

Path Finder

yes I want to extract the timestamp 21:20:00:456

0 Karma

Path Finder

This is the actual log event:

Feb 19 09:00:55 Feb 19 14:00:56 LDC-N26-SSLVPN4 AN_SQUID_LOG 1424354456.021 1 TCP_MISS/200 1670 GET /myaccess/logout.gif - DIRECT/ -

It is coming from syslog event.

I need splunk to extract timestamp from

Feb 19 14:00:56 LDC-N26-SSLVPN4


This is what I have entered in props.conf on indexer. Source is udp:514

TIME_PREFIX = \w+\s+\d+\s+\d+:\d+:\d+\s+\d+.\d+.\d+.\d+\s+

But even after doing that and restarting indexer, I am still not able to extract the required timestamp

Feb 19 14:00:56 LDC-N26-SSLVPN4

Please let me know what I am missing here

0 Karma


If time is ALWAYS exactly 5 hours off, the just make a timezone shift off the first time in the event. That would be the easiest thing to do.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...