Hi,
I have a series of devices coming into a syslog server. The format for the devices is as follows:
3 different formats:
mm/dd/hh:mm:ss
hh:mm:ss
d h
How do I configure timestamp formats for this if they are all the same sourcetype?
Thanks
See this article. It is probably all you need:
https://www.splunk.com/blog/2014/04/23/its-that-time-again.html
See this article. It is probably all you need:
https://www.splunk.com/blog/2014/04/23/its-that-time-again.html
Thanks for that!
Hi mwdbhyat,
try using the default sourcetype recognition, you can test it downloading an example of each one of your logs and trying to ingest using web interface.
If this methid doesn't recognize your logs, you have to use different sourcetypes for each one.
Bye.
Giuseppe