Splunk Search

_time field extraction

kulo
Engager

I found that the _time field in my event was a bit unusual

19756;10;7;mik;security;2017-08-04 10:57:33;test(20170731-20170804).xlsx;;1;0;et.exe;;

The _time field for this time is shown as follows: 17/08/04 20: 17: 08.040, accurate should be based on the event "2017-08-04 10:57:33" _time is 17/08/04 10: 57: 33.040.
I think the splunk matches the test in the event (20170731-20170804) .xlsx and then comes the _time, how do i let _time read the fifth; the number with the sixth; the date between the date

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

try using

TIME_PREFIX = ([^;];){5}
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Bye.
Giuseppe

adonio
Ultra Champion

fix it with props.conf
explanation here, read all the way through the page
http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/HowSplunkextractstimestamps
hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...