×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
NealBr
New Member
Member since: ‎08-03-2020
‎08-03-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-03-2020
Activity Feed
View All

Re: Extracting Date and Time from Events

by in Getting Data In
‎08-03-2020 11:13 AM
‎08-03-2020 11:13 AM
Found it!   CHARSET = AUTO EVENT_BREAKER = ([\r\n]+) EVENT_BREAKER_ENABLE = TRUE LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 100 SHOULD_LINEMERGE = 0 TIME_PREFIX = .+sso\d+.\s TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TRUNCATE = 2500 #NO_BINARY_CHECK = true category = Custom disabled = false ... View more

Re: Extracting Date and Time from Events

by in Getting Data In
‎08-03-2020 10:52 AM
‎08-03-2020 10:52 AM
Actually, the output has only two DateTime fields (the third one is just the event text). In total there are four fields. For example: _time:   2020-06-04 00:50:56 Timestamp:   Jun 04 00:50:56 PartitionDiskSpaceUsed:   100 Event:   Jun 4 01:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / Sorry, I'm new to Splunk and I don't understand your question: "Can you share the props.conf settings for this sourcetype?"   What is my sourcetype? I've no idea where to find my props.config file (but I'm searching online for more info about it.) ... View more

Extracting Date and Time from Events

by in Getting Data In
‎08-03-2020 08:20 AM
‎08-03-2020 08:20 AM
How do I extract the date and time from my events? Event Data Sample ------------------------- Jun 4 01:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / Jun 4 02:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / Jun 4 00:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / Jul 31 22:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home Jul 31 08:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home My Search ----------------- index=sso host=rofsso504* PartitionDiskSpaceUsed>25 earliest=-2mon | rename _raw as Event host as Host | eval Timestamp=strftime(_time, "%b %d %H:%M:%S") | table Host _time Timestamp PartitionDiskSpaceUsed Event | sort Host -Timestamp | table _time Timestamp PartitionDiskSpaceUsed Event What I want ------------------ I want the Timestamp column to contain the correct Event Date and Time, but currently it shows the DateTime of the search. 2020-06-04 00:50:56 Jun 04 01:27:01 100 Jun 4 01:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-06-04 00:50:56 Jun 04 02:27:01 100 Jun 4 02:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-06-04 00:50:56 Jun 04 00:27:01 100 Jun 4 00:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-07-31 00:50:56 Jul 31 22:27:01 26 Jul 31 22:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home 2020-07-31 00:50:56 Jul 31 08:27:01 26 Jul 31 08:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home What I get ------------ 2020-06-04 00:50:56 Jun 04 00:50:56 100 Jun 4 01:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-06-04 00:50:56 Jun 04 00:50:56 100 Jun 4 02:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-06-04 00:50:56 Jun 04 00:50:56 100 Jun 4 00:27:01 rofsso504a Usage: /dev/sda1 16G 16G 20K 100% / 2020-07-31 00:50:56 Jul 31 00:50:56 26 Jul 31 22:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home 2020-07-31 00:50:56 Jul 31 00:50:56 26 Jul 31 08:27:01 rofsso504a Usage: /dev/sda4 210G 53G 157G 26% /home   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-03-2020 02:33 PM