Splunk Search

How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

astalv
New Member

Hi everyone!

I have a log with a strange format. In the filename, it is a full date and an hour of event and the minute:second are in the events inside the file, line by line.

For example:
File name: 16110810.log // it means yymmddHH

Lines:
10:01 xxx xxx xxx // it means MM:SS
10:02 yyy yyy yyy // it means MM:SS

Does anybody have an ideas how to extract time correctly other than in search time with eval?

I tried changing datetime.xml, but I have also hour stamp in a file name and it doesn't worked. Now I'm thinking about overwriting the _time field at index time, but not sure it is possible. Maybe any workaround? I have this data in a dedicated index and with its own sourcetype, of course.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi astalv,

I don't think you can extract the timestamps info correctly from both your source file and raw data at index time. Of course, you can use eval at search time to achieve this, as you already know.

You can overwrite event metadata at parsing time for specific sourcetypes, but this applies only to these metadata: host, source, sourcetype. An example below:

props.conf
[source::udp:514]
TRANSFORMS = custom_sourcetyper

transforms.conf
[custom_sourcetyper]
SOURCE_KEY = _raw
REGEX = Custom$
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::custom_log

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...