Getting Data In

Datetime.xml - extracting hour that does not exist

twkan
Splunk Employee
Splunk Employee

Hello all,

I have a series of logs that looks like this:

200312,111523  -> this means 20 March 2012, 11:15:23 am
200312,53344  -> this means 20 March 2012, 05:33:44 am (note that the first 0 is missing in the hour)
200312,1428 -> this means 20 March 2012, 00:14:28 am (note that the first two 00 are missing in the hour)

I have already written the datetime.xml to cater for the first two scenarios. But for the 3rd one where the hour is totally missing, how do I cater for this on my datetime.xml?

Has anyone managed to think of a way to 'substitue' 00 as the hour if it's missing from the logs itself?

Thanks for any insights.

0 Karma
1 Solution

twkan
Splunk Employee
Splunk Employee

Okay, decided to write a script to pad the time with zeros before being indexed by Splunk.

View solution in original post

0 Karma

twkan
Splunk Employee
Splunk Employee

Okay, decided to write a script to pad the time with zeros before being indexed by Splunk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...