Splunk Search

How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

astalv
New Member

Hi everyone!

I have a log with a strange format. In the filename, it is a full date and an hour of event and the minute:second are in the events inside the file, line by line.

For example:
File name: 16110810.log // it means yymmddHH

Lines:
10:01 xxx xxx xxx // it means MM:SS
10:02 yyy yyy yyy // it means MM:SS

Does anybody have an ideas how to extract time correctly other than in search time with eval?

I tried changing datetime.xml, but I have also hour stamp in a file name and it doesn't worked. Now I'm thinking about overwriting the _time field at index time, but not sure it is possible. Maybe any workaround? I have this data in a dedicated index and with its own sourcetype, of course.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi astalv,

I don't think you can extract the timestamps info correctly from both your source file and raw data at index time. Of course, you can use eval at search time to achieve this, as you already know.

You can overwrite event metadata at parsing time for specific sourcetypes, but this applies only to these metadata: host, source, sourcetype. An example below:

props.conf
[source::udp:514]
TRANSFORMS = custom_sourcetyper

transforms.conf
[custom_sourcetyper]
SOURCE_KEY = _raw
REGEX = Custom$
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::custom_log

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...