The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
custom time series on x-axis
I have a custom app dumping a custom log to file every night that includes all events in that app. Each log entry has a time stamp, but Splunk only indexes the creation date of the file.
What Splunk reports is that there are 1000 events at midnight, instead of a 1000 events over the year.
How do I create a search/report that uses the timestamp from each entry as the x-axis?
Thank you.
Tags: timechart
Views: 33
Replies to This Discussion
-
Permalink Reply by Jordan Schroeder on -
Update: I was able to use a props.conf file to specify what the timestamp should be, and used
TIME_FORMAT=%m/%d/%Y
Now, anything timestamped before 8/28/2004 isn't being recognized as a timestamp and Splunk is grabbing the date of the log file instead. So, now I have 500 events spread out over 6 years (a good thing) and 500 events being recorded as happening today (a bad thing).
Any help on the timestamp issue?
-
Permalink Reply by Michael Wilde on -
If you want splunk to recognize older data, you can put a setting In your props.conf, just add
MAX_DAYS_AGO =
Set that to the number of days, 2190 would be six years. More or less, now you know which way to go.
stop splunk, clean your index (splunk clean eventdata -index main), restart splunk.
© 2012 Created by Michael Wilde.
