topic How can I take the second timestamp in props.conf? in Getting Data In

How can I take the second timestamp in props.conf?

lorscardala985 — Fri, 21 Jul 2023 17:33:35 GMT

how can i in the props.conf file tell Splunk to take the second timestamp as opposed to the first

Re: timestamp props.conf

isoutamo — Fri, 21 Jul 2023 09:32:30 GMT

this depends on your log file's content. Can you share it?

In common level you could add TIME_PREFIX on your props.conf to recognise correct place where your timestamp starts. See more from here https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/Configuretimestamprecognition

r. Ismo

Re: timestamp props.conf

lorscardala985 — Fri, 21 Jul 2023 09:43:04 GMT

i have events with this timestamp Sep 20 11:13:18 10.50.3.100 Sep 20 11:13:15 and i want to view only the second timestamp

Re: timestamp props.conf

isoutamo — Fri, 21 Jul 2023 09:49:23 GMT

In this case you could try something like

^(\w+[\s:\.]+){9}

on your TIME_PREFIX. I assume that 1st timestamp field is first characters on your log entry. If not then ^ should be fixed to match where this starts.