Epoch time field extraction in splunk

Question

How can we write regex or field extraction for below logs? Field is start and end where value is in epoch format and i want to change this in human readable format ..

cs7=45.45 cs7Label=latitude cs8=28.05 cs8Label=longitude Customer=Romania-UPC start=1604484735041 request=scoala.bibliotecapemobil.ro/download.php ref=https://scoala.bibliotecapemobil.ro/893/borgia requestMethod=GET qstr=book_id\=893&user_id\=&download\=pdf cn1=200 app=HTTPS act=REQ_PASSED deviceExternalId=37982221230540227 sip=195.191.47.151 spt=443 in=45 xff=82.208.137.89 cpt=62542 src=82.208.137.89 ver=TLSv1.3 TLS_AES_128_GCM_SHA256 end=1604484735097

score 0 · Answer 1 · answered Nov 05 '20 at 15:33

0

Field extraction at search time can be done with the extract command.

... | extract pairdelim=" " kvdelim="=" | ...

Convert the time field using strptime().

... | eval start=strptime(start, "%s%3N")

Index-time field extraction should be automatic, but try these props.conf settings for both extraction and time processing.

[mysourcetype]
TIME_PREFIX = start=
TIME_FORMAT = %s%3N
MAX_TIMESTAMP_LOOKAHEAD = 13
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
KV_MODE = auto

answered Nov 05 '20 at 15:33

RichG

9,063
2
18
29

thanks Rich .. but i wanted to change this to human readable format .. – Supriya Sharma Nov 05 '20 at 16:37
No problem. Use `strftime()` for that. `... | eval startstr=strftime(strptime(start, "%s%3N"), "%c")`. – RichG Nov 05 '20 at 16:40
also can i get the time zone of epoch time like CEST,GMT? – Supriya Sharma Nov 09 '20 at 10:31
To get milliseconds, just change the format string. See the Search Reference manual for how to write format strings. `... | eval startstr=strftime(strptime(start, "%s%3N"), "%Y-%m-%dT%H:%M:%S.%3N%Z")` – RichG Nov 09 '20 at 18:21
Splunk converts timestamps to UTC when they're ingested and converts them to the user's preferred time zone on display. – RichG Nov 09 '20 at 18:22
thanks a lot Rich for your quick help ..its working perfectly .. – Supriya Sharma Nov 12 '20 at 11:27

Epoch time field extraction in splunk

1 Answers1