Getting Data In

Custom Datetime.xml not working for log with multiple timestamp

hemendralodhi
Contributor

Hello,

We have log which have 5 different timestamp. I am trying to use custom datetime.xml created using splunk train dates cmd but it is not working.

Different Timestamps

2018-01-05_18:15:42.208
2018-01-05 18:15:42
Jan 5, 2018 6:15:52 PM
<05-Jan-2018 6:15:58,916 EST PM>

custom datetime.xml

    <text><![CDATA[\<(\w+)\s(\d+),\s(\d+)]]></text>


    <text><![CDATA[,\s\d+\s(\d+):(\d+):(\d+)\s(\w+)\s(\w+)]]></text>


    <text><![CDATA[(\d+)-(\d+)-(\d+)]]></text>


    <text><![CDATA[-\d+-\d+_(\d+):(\d+):(\d+)\.(\d+)]]></text>



    <text><![CDATA[(\d+)-(\d+)-(\d+)]]></text>


    <text><![CDATA[-\d+-\d+\s(\d+):(\d+):(\d+)]]></text>



    <text><![CDATA[(\w+)\s(\d+),\s(\d+)]]></text>


    <text><![CDATA[,\s\d+\s(\d+):(\d+):(\d+)\s(\w+)]]></text>



    <text><![CDATA[\<(\d+)-(\w+)-(\d+)]]></text>


    <text><![CDATA[\w-\d+\s(\d+):(\d+):(\d+),\d+\s(\w+)\s(\w+)]]></text>

props.conf
TZ_ALIAS=EST=GMT+11
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
disabled=false
DATETIME_CONFIG = /opt/splunk/etc/system/local/datetime.xml
LINE_BREAKER=([\r\n]+)(?:(?:<(\w{3})\s(\d{1,2}),\s(\d{4})\s(\d{1,2}):(\d{2}):(\d{2})\s(\w{2})\s(\w{3})>)|(?:(\d{4})-(\d{2})-(\d{2})_(\d{2}):(\d{2}):(\d{2}).(\d{3}))|(?:(\d{4})-(\d{2})-(\d{2})\s(\d{2}):(\d{2}):(\d{2}))|(?:(\w{3})\s(\d{1,2}),\s(\d{4})\s(\d{1,2}):(\d{2}):(\d{2})\s(\w{2}))|(?:<(\d{1,2})-(\w{3})-(\d{4})\s(\d{1,2}):(\d{2}):(\d{2}),(\d{3})\s(\w{3})\s(\w{2})>))

When testing using above configuration using Add Data - Splunk is not showing any data and reporting "No results found. Please change source type, adjust source type settings, or check your source file."

0 Karma

hemendralodhi
Contributor

Here is the configuration for datetime.xml
datetime.xml

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...