Getting Data In

How to extract multiple timeformats

mwdbhyat
Builder

Hi,

I have a series of devices coming into a syslog server. The format for the devices is as follows:

3 different formats:
mm/dd/hh:mm:ss
hh:mm:ss
d h

How do I configure timestamp formats for this if they are all the same sourcetype?

Thanks

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

See this article. It is probably all you need:

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

0 Karma

mwdbhyat
Builder

Thanks for that!

0 Karma

woodcock
Esteemed Legend
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mwdbhyat,
try using the default sourcetype recognition, you can test it downloading an example of each one of your logs and trying to ingest using web interface.
If this methid doesn't recognize your logs, you have to use different sourcetypes for each one.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...