Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nitrogaute
nitrogaute
New Member
Member since:
10-28-2014
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-28-2014 |
Activity Feed
- Posted Re: How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 06:00 AM
- Posted Re: How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 05:52 AM
- Posted Re: How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 05:38 AM
- Posted Re: How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 05:28 AM
- Posted Re: How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 04:52 AM
- Posted How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 04:04 AM
- Tagged How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 04:04 AM
- Tagged How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 04:04 AM
- Tagged How to parse out milliseconds from timestamp in log file? on Getting Data In. 10-28-2014 04:04 AM
- Posted Re: Need help to get Timestamp correctly on Getting Data In. 10-28-2014 03:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
10-28-2014
06:00 AM
Hmm, I see you re point. But I still think it s strange that Splunk does not handle relative time...
... View more
10-28-2014
05:52 AM
I could convert milliseconds to hours, minuttes and seconds.. But would that make any difference? Or do I need the date also to give Splunk sufficient reference?
I would assume Splunk sets the reference point at 0 in a 7 digit milisecond timestamp..
... View more
10-28-2014
05:38 AM
It knows the first entry. Should`t that be OK?
... View more
10-28-2014
05:28 AM
No, the asterisks is not part of the data. See the logfile entries in the above.
The logfile represent modbus communications between a master and a slave. The milliseconds is since last restart of the master node. I want to trend out timeout periods of the communications and look at what happens just before a period of timeout/no RX.
I`m also interested in other ways to do this. The logfiles are aprox 250 mb
... View more
10-28-2014
04:52 AM
That makes the timestamp appear in the in the error message. No changes appart from that in Data preview.
Could not use strptime to parse
timestamp from "9281736 : COUNT 1003n
...... Make sure a prefix pattern is
specified if the events don`t begin
with a timestamp. Failed to parse
timestamp. Defaulting to file modtime.
... View more
10-28-2014
04:04 AM
BREAK_ONLY_BEFORE=\d{7}
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%3N
TIME_PREFIX=\d{7}
Trying to parse out the millisecond timestamp from this log file, 9281736 :
9281736 : COUNT IN 1003
Tx: 01 04 00 71 00 02 21 d0 ...q..!.
Rx: 01 04 04 00 08 0a 28 7c f8
9282136 : COUNT IN 1003
Tx: 01 04 00 c9 00 02 a1 f5 ........
Rx: 01 04 04 00 08 00 00 7a 46
I suspect my TIME_FORMAT is wrong, because it breaks up events correctly with regex \d{7}.
But according to the error message it doesn't look for the timestamp in the correct spot. Or is it?
Could not use strptime to parse timestamp from ": COUNT 1003\n ......
Make sure a prefix pattern is
specified if the events don`t begin
with a timestamp.
Failed to parse timestamp. Defaulting to file modtime.
Any suggestion would be much appreciated!
... View more
10-28-2014
03:58 AM
I have a similar problem:
BREAK_ONLY_BEFORE=\d{7}
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%3N
TIME_PREFIX=\d{7}
Trying to parse out the millisecond timestamp from this log file, 9281736 :
9281736 : COUNT IN 1003
Tx: 01 04 00 71 00 02 21 d0 ...q..!.
Rx: 01 04 04 00 08 0a 28 7c f8
9282136 : COUNT IN 1003
Tx: 01 04 00 c9 00 02 a1 f5 ........
Rx: 01 04 04 00 08 00 00 7a 46
I suspect my TIME_FORMAT is wrong, because it breakes up events correctly.
Get the error of:
Could not use strptime to parse timestamp from ": COUNT 1003\n ......
Make sure a prefix pattern is
specified if the events don`t begin
with a timestamp.
Failed to parse timestamp. Defaulting to file modtime.
Any suggestion would be much appreciated!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
