Getting Data In

Recognizing timestamps split across multiple lines

MatMeredith
Path Finder

My event have separate date and time fields on separate lines. E.g.


Date: 29 April 2013

Time: 12:02:03.6

Is it possible to configure Splunk to automatically extract timestamps for these events, piecing together the date and time as necessary?

Many thanks!

Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Not automatically. I would use datetime.xml here and define custom extractions.

View solution in original post

0 Karma

_d_
Splunk Employee
Splunk Employee

Not automatically. I would use datetime.xml here and define custom extractions.

0 Karma

MatMeredith
Path Finder

That's what I feared... Thanks!

0 Karma

kristian_kolb
Ultra Champion

Splunk is fairly good at interpreting timestamps by itself. You could try to index a log file and see how well it performs. Two things, though;

1) ensure that you have correct line_breaking, since splunk will normally break events when on the line where it encounters a timestamp. So if you have some lines before the timestamp that are part of the event, you may need to get explicit with some props.conf settings (either a SHOULD_LINEMERGE=true / MUST_BREAK.., BREAK_ONLY.. combo, or SHOULD_LINEMERGE=false / LINE_BREAKER combo. See the docs for props.conf for this.

2) You'll probably need to adjust the MAX_TIMESTAMP_LOOKAHEAD to a higher number than the default 150.

See this (and the following) page(s);

http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Hope this helps,

Kristian

0 Karma

MatMeredith
Path Finder

Sadly this doesn't seem to work. Splunk cannot automatically figure out the separate date and time fields... Thanks though!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...