Getting Data In

TIMESTAMP QUERY

srajanbabu
Explorer

I have my log as
SNM4 PGHF14LR.866F :: 04/03/13 11:46:32 :: Received file MOBIUSJ741.20130403 - 317982 bytes transferred
SNM4 TDAM1EBY.864F :: 04/03/13 11:46:34 :: Execute_profile_recs: Submitting ftp trans due to quit command
SNM4 TDAM1EBY.864F :: 04/03/13 11:46:36 :: Execute_profile_recs: Issuing Put of TDAMUSA_20130403_1147.enc to 'MD.B.DMVR.DV180-50.TDAM1EBY(+1)'

From this i want to extract only the timestamp at which the recieve file event has taken place like
want the result as
timestamp bytes transferred
04/03/13 11:46:32 317982 bytes transferred

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Isn't this information already present in the _time field? If not, or if you need to extract it anyway;

index=blah sourcetpe=bleh "Received file" 
| rex "::\s(?<timestamp>\S+\s\S+)\s::" 
| rex "\s(?<bytes>\d+)\sbytes\stransferred$"
| table timestamp bytes

If you can use the default extracted time (in _time) then just skip the first rex and use _time in the table instead of timestamp.

Hope this helps,

K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...