Need assistance in setting a sourcetype--date/time

[NanSplk01]

I am trying to create a sourcetype for a new client:

Note StartDate=xxxx is where the log begins.  However the StartTime=*** is not with it, but I need both int he logs.  How do I create this sourcetype? 

C:\Program Files\Universal\UAGSrv\xxx>set StartDate=Mon 07/29/2024

C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024

C:\Program Files\Universal\UAGSrv\xxx>set sdm=07

C:\Program Files\Universal\UAGSrv\xxx>set sdd=29

C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024

C:\Program Files\Universal\UAGSrv\xxx>set sdm=07

C:\Program Files\Universal\UAGSrv\xxx>set sdd=29

C:\Program Files\Universal\UAGSrv\xxx>set StartTime=14:45:09.56

any assistance would be very helpful and appreciated.

[NanSplk01]

It is one of several blocks of lines inside the log file.  Each starts with the little snippet I put above and then has any number of lines after it.  While the file is a .txt, the look to me would be a xml document that pushes out the log file.  I've not seen one like it before.  I was thinking I'd need a props or transform or both to set this date/time, but it's my first experience with it.

[richgalloway]

While every sourcetype should have props defined, this may be beyond what transforms can do.  Timestamp extraction happens before transforms are applied, which is why I suggested an input script do the work.

[richgalloway]

Wow.  The developer that created that log needs to be taught how to use Splunk so he can see how awful his creation is.

Is that one event or several?  Or is that the prologue to the log file?

You may be able to use a custom datetime.xml file or you may want to consider an input script that normalizes the timestamp.

[NanSplk01]

Well, I did find another line which has the date and time, but it's over 15 lines into the log file.  We need to start with the first line which is the beginning of the stanza, but get the timestamp which is 15th line showing after the opening line shown below

C:\Program Files\Universal\UAGSrv\xxxl_p01.nam>set StartDate=Tue 07/23/2024 

This is the actual timestamp which I think would work since it has both date and time (hoping that's what the _80514 is the time??

 Files\Universal\UAGSrv\xxx_p01.nam>set timestamp=20240723_80514

[richgalloway]

You probably could define TIME_PREFIX to find that timestamp.  However, is the timestamp present for every event or just once in the file?  If the latter, then start writing code to re-process that file into something Splunk can ingest more easily.