Getting Data In

How do I configure timestamp extraction where day may be one or two digits

clmiller
Engager

I have a timestamp of form
[10/15/11 11:55:08:992 PDT] . . . log entry text . . .

I expect I can try the following specifier in props.conf file for the above Oct 10th 2011 date format:
TIME_PREFIX = ^.
MAX_TIMESTAMP_LOOKAHEAD = 22
TIME_FORMAT = %y/%d/%m %k:%M:%S
But for dates where the day of the month of log entry is less than 10 I hve something like:
[12/8/11 11:55:08:992 PDT] . . . log entry text . . .
My understanding is %d works for a two digit day format, but I don't see a good option when day can be two digits or a single non-padded digit day of month representation.
Suggestions?

Tags (2)

clmiller
Engager

I believe unfortunately that the "%e" opption still winds up with two characters.
Though lot of python tutorials do not mention it, when the day number is less than 10
"%e" seems to front pad with a blank, where "%d" frontpads with a zero.
As is born out by the folowing ksh and python script content and output.

#----------------------

#!/bin/ksh

# ksh_date_with_d_and_e

# If current day of the month is greater than 9 then print date time out

# for the 9th of the month. Otherwise print out current date time

#

DAY=date +%e

if [ $DAY -gt 9 ]

then

let BACK=$DAY-9

else

BACK=0

fi

date -d "$BACK days ago" +"%y/%d/%m %k:%M:%S"

date -d "$BACK days ago" +"%y/%e/%m %k:%M:%S"

# END

SAMPLE OUTPUT:

11/09/12 10:50:15

11/ 9/12 10:50:15

#----------------------

#!/usr/bin/python

# python_date_with_d_and_e"

# Using hard coded date here

#

import time

t = (2011, 12, 9, 17, 3, 38, 1, 48, 0)

t = time.mktime(t)

print time.strftime("%y/%d/%m %k:%M:%S", time.gmtime(t))

print time.strftime("%y/%e/%m %k:%M:%S", time.gmtime(t))

# END

SAMPLE OUTPUT:

11/09/12 23:03:38

11/ 9/12 23:03:38

#----------------------

Unless splunk does something special for "%e" different than python or ksh,

it seems this would still not match for a single character day in date field

I have not had a chance to experiment further so is still conjecture on my part.

0 Karma

FRoth
Contributor

Yes - it does not do what it is supposed to do. I want to extract the day from "Aug 18 17:11:16" and "Aug 8 17:11:16". %e is not white space padded.

0 Karma

kristian_kolb
Ultra Champion

Hi, not that I've tried it, but %e might work for you.

According to http://www.tutorialspoint.com/python/time_strftime.htm

%d - day of the month (01 to 31)
%e - day of the month (1 to 31)

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...