topic Timestamp extraction from log in Getting Data In

Timestamp extraction from log

linu1988 — Wed, 19 Jun 2013 18:29:14 GMT

Hello,
I am trying to extract time stamp from log file which will help me to use log TimeStamp instead of splunk time stamp.

I have tried to match the time using regex in props.conf but the regex is not at all showing the date. I have tried everything but Splunk doesn't recognize the log date. Please guide me as am not an regex expert.

TIME_PREFIX=^\d{4}:\d{1,2}:\d{1,2}-\d{1,2}:\d{1,2}

sample log:

2013:6:18-11:18 -- IP:: 10.121.230.155 REQUEST URI:: www...

Re: Timestamp extraction from log

cschmidt0121 — Mon, 28 Sep 2020 14:08:04 GMT

I'm pretty sure you should be editing TIME_FORMAT, not TIME_PREFIX. Not only that, you aren't specifying which fields are year, month, etc.

Re: Timestamp extraction from log

linu1988 — Mon, 28 Sep 2020 14:08:23 GMT

Hello,
below gave me the solution 🙂

DATE_TIMECONFIG=NONE
NO_BINARY_CHECK=1
TIME_FORMAT=%y:%m:%d-%H:%M

Re: Timestamp extraction from log

thambisetty_bal — Tue, 29 Sep 2020 10:07:32 GMT

DATE_TIMECONFIG=NONE this is wrong there is no attribute like that find correct one below
DATETIME_CONFIG=NONE