topic Re: Help me with Time formt and time prefix in Splunk Enterprise

Help me with Time formt and time prefix

shreya17 — Wed, 07 Jul 2021 18:58:50 GMT

I need help to write time format and time prefix for below timelogs. Please note these are seperate logs, hence need different timeformat and timeprefix for all three. Help will be appreciated, Thanks in advance!

####<30/06/2021 11:13:08,975 PM AEST>

####<Jul 3, 2021 4:25:41,233 PM AEST>

[2021-07-06T23:59:58.849+10:00]

Trying to get this added in props.conf file in below format, need assistance with timeformat and timeprefix

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT =
TIME_PREFIX =

Re: Help me with Time formt and time prefix

burwell — Wed, 07 Jul 2021 19:40:57 GMT

Hi. Instead of us just providing you with the answer, do you want to take a crack at the timestamp settings?

Here are documented examples on the date/time format settings: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Examples

I also came across this handy video that shows you how to interact with Splunk and test these settings.

https://www.youtube.com/watch?v=Q5EWCT79nZ4

Give the settings a try and let us know what works/doesn't work or that you have questions about. Thanks!

Re: Help me with Time formt and time prefix

shreya17 — Thu, 08 Jul 2021 15:12:17 GMT

Hey @burwell I did give a try. Let me know if this is good.

####<30/06/2021 11:13:08,975 PM AEST>

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %d/%m/%Y %I:%M:%S,%3N %p
TIME_PREFIX = \####<

####<Jul 3, 2021 4:25:41,233 PM AEST>

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %b %d, %Y %I:%M:%S,%3N %p
TIME_PREFIX = \####<

[2021-07-06T23:59:58.849+10:00] -- (not sure of this one)

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX = \[

Re: Help me with Time formt and time prefix

burwell — Fri, 09 Jul 2021 20:53:54 GMT

@shreya17 Great job!

I tested these and they seem correct.

A couple of settings I like to add

MAX_TIMESTAMP_LOOKAHEAD .. make it be the total number of characters in the time including timezone etc
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+).. This one you put the regular expression that matches the beginning of an event. That way if there's some garbage lines they won't be treated as single events (if you want that) e.g. for 2 of your events it would be LINE_BREAKER=([\r\n]+\####<
TRUNCATE=9999 or whatever you want. The maximum line length you will accept