My event have separate date and time fields on separate lines. E.g.
Date: 29 April 2013
Time: 12:02:03.6
Is it possible to configure Splunk to automatically extract timestamps for these events, piecing together the date and time as necessary?
Many thanks!
Not automatically. I would use datetime.xml here and define custom extractions.
Not automatically. I would use datetime.xml here and define custom extractions.
That's what I feared... Thanks!
Splunk is fairly good at interpreting timestamps by itself. You could try to index a log file and see how well it performs. Two things, though;
1) ensure that you have correct line_breaking, since splunk will normally break events when on the line where it encounters a timestamp. So if you have some lines before the timestamp that are part of the event, you may need to get explicit with some props.conf
settings (either a SHOULD_LINEMERGE=true / MUST_BREAK.., BREAK_ONLY..
combo, or SHOULD_LINEMERGE=false / LINE_BREAKER
combo. See the docs for props.conf
for this.
2) You'll probably need to adjust the MAX_TIMESTAMP_LOOKAHEAD
to a higher number than the default 150.
See this (and the following) page(s);
http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
Hope this helps,
Kristian
Sadly this doesn't seem to work. Splunk cannot automatically figure out the separate date and time fields... Thanks though!