Getting Data In

Timestamp separeted by many field/character

emaccaferri
Communicator

Hi!
I'm trying to extract a timestamp from a log like

"0123456" "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00"

(letters' number is undefined)

By default Splunk recognize all "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00" as a timestamp.

I tried to use %d/%m/%Y\D+\d"%H:%M inside the manager but it doesn't work.
Any idea?

Tags (1)
0 Karma

bmacias84
Champion

Another ideas would be to would be to overide the MetaData using a transform. How familar are you with transforms.

0 Karma

bmacias84
Champion

what does your props.conf file for the sourcetype look like? MAX_TIMESTAMP_LOOKHEAD is 150 char, but you event doesnt pass that limit.

0 Karma

grijhwani
Motivator

This should be along the lines you want, if I understand the question correctly:

{search} | rex "(?<fdate>\d{2}/\d{2}/\d{4}).*(?<ftime>\d{2}:\d{2})" | eval dateandtime=fdate." ".ftime | table dateandtime

grijhwani
Motivator

So are you trying to say that - from your example data - you would want to extract the final value "01/02/2000 12:00"?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...