Hello to everyone!
I have a curious situation:
I have log files that I collecting via SplunkUF
This log file does not contain a whole timestamp - one part of the timestamp is contained in the file name, and the other is placed directly in the event
As I found in the other answers, I have options.
1. INGEST_EVAL on the indexer layer: I did not understand how I could take one part from the source and glue it with _raw data
Link to the answer
2. Use handmade script to create a valid timestamp for events - this is more understandable for me, but it looks like "reinventing the wheel"
So the question is, may I use the first option if it is possible?
This is the an example of the source:
E:\logs\rmngr_*\24020514.log
* - some number
24 - Year
Month - 02
Day - 04
Hour - 14
And this is an example of the event:
45:50.152011-0,CONN,3,process=rmngr,p:processName=RegMngrCntxt,p:processName=ServerJobExecutorContext,OSThread=15348,t:clientID=64658,t:applicationName=ManagerProcess,t:computerName=hostname01,Txt=Clnt: DstUserName1: user@domain.com StartProtocol: 0 Success
45:50.152011 - Minute, Second and Subsecond
Hi
you could look my old post https://community.splunk.com/t5/Getting-Data-In/How-to-apply-source-file-date-using-INGEST-as-Time/m....
You need to do small modifications to it.
You could test this like I have done on above post. If needed, don’t hesitate to ask more help.
Remember that INGEST_EVAL must be an one command only.
r. Ismo
Hi
you could look my old post https://community.splunk.com/t5/Getting-Data-In/How-to-apply-source-file-date-using-INGEST-as-Time/m....
You need to do small modifications to it.
You could test this like I have done on above post. If needed, don’t hesitate to ask more help.
Remember that INGEST_EVAL must be an one command only.
r. Ismo
After a lot of tries, I finally did it
Looks simple when you know what to do
Thank you for advertising the substr function 😃
The final result is below
props.conf
[oce_file_rphost]
TRANSFORMS-oce_file_tc0 = oce_file_tc0
LINE_BREAKER = ()\d{2}:\d{2}.\d+-\d+,
SHOULD_LINEMERGE = false
transform.conf
[oce_file_tc0]
INGEST_EVAL = _time = strptime("20" + replace(source,".*\\\\(\d{8}).log","\1") + substr(_raw,0,12),"%Y%m%d%H%M:%S.%6Q")