Getting Data In

Convert DateTime format befor indexing and write in _time. Time of event have hex format.

chernigin_yuri
Explorer

Hello everybody!
I have trouble with parsing time of event in time indexing.Fields of time in my raw event have hex system - this unix time. How i can to convert from hex to decimal and convert from unix to human readble date time. But i wanna do this before indexing, fore example in props.conf and transforms.conf, i need write down this time in _time

0 Karma
1 Solution

Ravan
Path Finder

I tried to convert the time value(0x56A7DEC7) using below link and got the date as "GMT: Tue, 26 Jan 2016 21:01:59".

https://www.epochconverter.com/hex

If the conversion is accurate , you can follow the xml option mentioned in below post.

https://answers.splunk.com/answers/4880/hex-encoded-unix-timestamp.html

View solution in original post

0 Karma

Ravan
Path Finder

I tried to convert the time value(0x56A7DEC7) using below link and got the date as "GMT: Tue, 26 Jan 2016 21:01:59".

https://www.epochconverter.com/hex

If the conversion is accurate , you can follow the xml option mentioned in below post.

https://answers.splunk.com/answers/4880/hex-encoded-unix-timestamp.html

0 Karma

chernigin_yuri
Explorer

I tried like this:

https://answers.splunk.com/answers/4880/hex-encoded-unix-timestamp.html

and like this:

https://answers.splunk.com/answers/30852/hex-time-stamp-extraction-issues-with-datetime-config.html

But it did not work out.

Below my configurations:

props.conf

[test_write_hextime_to_timestamp]
DATETIME_CONFIG = /etc/my_hex_epoch_datetime.xml
MAX_TIMESTAMP_LOOKAHEAD = 8
TIME_PREFIX = time="
BREAK_ONLY_BEFORE = <telegram
MUST_BREAK_AFTER = </telegram>
REPORT-test-hex-convert = REPORT-test-hex-convert
EVAL-date_time_test = strftime(tonumber(time, 16), "%m:%d:%Y %H:%M:%S")

my_hex_epoch_datetime.xml

<define name="_hexepoch" extract="hexepoch">
    <text><![CDATA[time="0x([\da-fA-F]{8})]]></text>
</define>
<timePatterns>
    <use name="_hexepoch"/>
</timePatterns>
<datePatterns>
</datePatterns>
0 Karma

Ravan
Path Finder

I tried with a sample data and it does work. Can double check stanzas and file permissions..?

Here are the configs i have. (Avoid the spaces in the config file line beginnings)

props.conf

[your sourcetype]
TIME_PREFIX = time="
MAX_TIMESTAMP_LOOKAHEAD = 16
BREAK_ONLY_BEFORE = <telegram
MUST_BREAK_AFTER = </telegram>
DATETIME_CONFIG = /etc/my_hex_epoch_datetime.xml

$SPLUNK_HOME/etc/my_hex_epoch_datetime.xml

<datetime>
          <define name="_hexepoch" extract="hexepoch">
            <text><![CDATA[0x([A-Fa-f0-9]{8})]]></text>
          </define>
          <timePatterns>
            <use name="_hexepoch"/>
          </timePatterns>
          <datePatterns>
          </datePatterns>
</datetime>

chernigin_yuri
Explorer

Many thanks!!! Success!
Your configuration is rigth.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share some sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

chernigin_yuri
Explorer

For example:

<telegram time_formatted="undefined date" time="0x56A7DEC7" type="16" datalen="2001"> // this is the title of each event.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...