topic Re: Need assistance to write the props in Getting Data In

Timestamp parsing from filename

jackin — Mon, 13 Mar 2023 18:06:57 GMT

I want to write the props for below logs.

Actually the logs are coming with no timestamp and the file name having the timestamp.

These are the logs:

Message Is: https POST failed: . Status Is: Ok

Message Is: https POST successful: 200. Status Is: Ok

Changed .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac

Unable to change .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac

File name coming like

zscalerhttp_2023-01-09-18-03-25

Can anyone help to write the props for this logs..

Re: Need assistance to write the props

PickleRick — Mon, 13 Mar 2023 18:05:17 GMT

Let me get this straight - you have a separate file per each event?

Re: Timestamp parsing from filename

jackin — Mon, 13 Mar 2023 18:13:52 GMT

Yes @PickleRick

Re: Timestamp parsing from filename

PickleRick — Mon, 13 Mar 2023 20:41:26 GMT

OK. There is no setting that would allow you to extract timestamp from filename or path directly. The only way I see is to use a INGEST_EVAL functionality. See https://conf.splunk.com/files/2020/slides/PLA1154C.pdf (slide 28 onwards)

Re: Need assistance to write the props

jackin — Tue, 14 Mar 2023 03:24:13 GMT

Yes @PickleRick