Getting Data In

Add new custom timestamp

Eagleman
New Member

Hello

I have a timestamp like Oct28-215189[ERROR]remoteHost: something

I tried to train splunk to recognize it but without luck.

could you give me some help ?

Thanks.

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You can configure Splunk to parse a time field specifically using props.conf

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.

[my_sourcetype]
TIME_PREFIX=^
TIME_FORMAT=%b%d-%H%M%S

That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You can configure Splunk to parse a time field specifically using props.conf

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.

[my_sourcetype]
TIME_PREFIX=^
TIME_FORMAT=%b%d-%H%M%S

That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.

dwaddle
SplunkTrust
SplunkTrust

yes, you should be able to extract the host using a regex ... docs cover it here - http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments .. if this doesn't get you going, I recommend you submit a new question specific to that. (Trying to handle follow-ons in comments can get difficult)

0 Karma

Eagleman
New Member

Thanks 😛 I did the same but propably it didn't work because i forgot the "^". Something more. Is there any way to extract the host ? (it's right after [ERROR]

0 Karma

Eagleman
New Member

a typo in the typo. where i say "type" i mean typo

0 Karma

Eagleman
New Member

Ups. you are right. 89 is a type. actually it is
Oct28-215129[ERROR]remoteHost: something

as you guess, it represents "MonDD-HHMMSS"

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Some more information would be necessary to help with this. I assumed at first that this was "MonDD-HHMMSS" -- but 89 seconds did not make sense. In that example above, what date/time does it actually represent?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...