Splunk Search

How to extract time manually ?

moiezuddin
Explorer

What is the query to extract time manually for a span of minute?

Tags (1)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

The way I read your question, "extract time manually for a span of minutes" it sounds like you want to include the earliest, and latest span in your search.

index=blah sourcetype=foo earliest="4/20/2015:20:00:00" latest="4/20/2015:20:22:00"|stats count by whatever

If you want to know how to get Splunk to extract either the first or second timestamp in your log, you will need to decide which one. They seem to be indicating different timezones as the first one is 11pm and the 2nd one is 8pm. So pick one...

Those are settings that you want to apply in props.conf. In fact, if it is the first one... just add LINE_BREAKER=([\r\n]+)\d\/\d{2}\/\d{2} to props.conf under the stanza for this source/sourcetype and Splunk will grab the first one. if you want the second one, then you would add LINE_BREAKER and TIME_PREFIX which in this case is nice and easy, as it begins with a left square bracket.

All together it would look like this:

[sourcetypename]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d\/\d{2}\/\d{2}
TIME_PREFIX = \[
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

stephanefotso
Motivator

Hello! Can i get your time format?

SGF
0 Karma

moiezuddin
Explorer

Sample Log

4/20/15
11:47:00.000 PM
[04/20/2015][20:47:40.461][2020398512][s3214933/r21][Center realm][][][][][][206450682][][][][][][centerusushwswp222lprd][** Status: Authorized. ][]

0 Karma

juvetm
Communicator

hi moiezuddin
can we have the time format pl

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...