This package contains a segmenters.conf for ISO8601 datetime stamps.
After enabling this, Splunk will ignore ISO8601 timestamps at the start of an event in its indexing process.
The timestamp will be correctly interpreted, _time
will be set, but the timestamp will not go in the free text search index.
Example, in the following log entry:
2018-10-14T10:54:12+00:00 hostname liblogging-stdlog: [origin software="rsyslogd" swVersion="8.24.0" x-pid="19060" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Terms like 2018
, 10
, 14T10
, 54
, 12
, etc will not appear in the index and will not be searchable.
To enable, reference it in props.conf
. It cannot be configured from the Splunk GUI.
This Add-On needs to be installed on indexers only.
[syslog]
SEGMENTATION = iso8601
or
[source:/var/log/remote/*/*/*.log]
SEGMENTATION = iso8601
See also: https://www.duanewaddle.com/splunk-bucket-lexicons-and-segmentation/
This package contains segmenter.conf for ISO8601 datetime stamps.
After enabling this, Splunk will ignore ISO8601 timestamps at the start of an event in its indexing process.
The time will be correctly interpreted, _time will be set, but the timestamp will not go in the free text search index.
To enable, reference it in props.conf. It cannot be configured from the Splunk GUI.
[syslog]
SEGMENTATION = iso8601
or
[source:/var/log/remote///*.log]
SEGMENTATION = iso8601
See also:
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.