×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Pharaon
Engager
Member since: ‎07-16-2018
‎06-05-2020
Community Statistics
Posts 2
Solutions 1
Karma Given 1
Karma Received 0
Member Since ‎07-16-2018
View All

Re: How can I propagate date+hour to each next eve...

by in Getting Data In
‎07-18-2018 01:10 AM
‎07-18-2018 01:10 AM
There is no easy way in splunk. Have to use Powershell addon with the following command for upload Get-ChildItem '\*.log' -Recurse | Get-Content | %{if($_ -match '^@@'){$a=($_ -replace '^@@(\d{2})\/(\d{2})\/(\d{4})(\d{2})','$3-$2-$1T$4:');"$($a)00:00"}else{"$a$($ -replace '^(\d{2})(\d{2}.\d{3})', '$1:$2 ')"}} ... View more

How can I propagate date+hour to each next event i...

by in Getting Data In
‎07-16-2018 12:44 AM
‎07-16-2018 12:44 AM
Hi. I am a newborn splunk user. Logs come in the following format --Format-- @@dd/mm/yyyy_HH MMSS.msecond|Message... .... @@dd/mm/yyyy_HH MMSS.msecond|Message... Sample: @@10/07/2018_20 4117.824|MessageA 4117.826|MessageB 4118.007|MessageA 4118.010|MessageC @@10/07/2018_21 1107.284|MessageD 1221.621|MessageB 2128.107|MessageE 4817.112|MessageF How can I capture date+hour and apply to each event at indexing time. E.g. for the last message in the sample I need something like below 10/07/2018 21:48:17.112 MessageF Or how to make Splunk recognize a timestamp properly when hour is linked to date and precise time is linked to each message? Appreciate your help. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All