Hi,
I have problem extracting fields from a log where the first field is in the beginning of the row. I want to extract the time when the the row was logged (LOGTIME) and the timestamp from the application (STARTTIME). Any clue how to do that?
My query (which doesn't work):
index=xxx source=yyy | rex "^(?P
Sample log row:
2012-04-23 04:58:48,142 [xxx.yyy.zzz.vvv] 123 /functionname 123 ms / startTime=1327312727&dataX=XXX&dataY=2371316&endTime=1335175127&dataZ=1&dataW=YYY / result=1234567
Any help is appreciated!
Do you really need to make a separate extraction for those???
If the first timestamp is used by Splunk for indexing, it's automatically available in the internal _time
field.
Unless you have turned off automatic field extraction, the startTime
should be extracted as well, since it's a regular key=value
format.
Note: you may have to use the strftime
function for eval
when presenting date/time to make it nicer to read for a human.
Hope this helps,
Kristian
Great, _time will work for me.
logtime will be same as _time in my application
Thanks!
It works! Thanks!