https://community.splunk.com/t5/Getting-Data-In/Discard-log-lines-that-do-not-start-with-a-timestamp/m-p/71177#M14486 <P>Is there a property that would allow me to discard log lines that don't start with a timestamp? I realize that I can nullqueue them based on not matching a pattern, but I thought I remembered seeing something specifically pre-defined for timestamps.</P> <P>Thanks</P> Thu, 31 Mar 2011 00:42:53 GMT mslvrstn 2011-03-31T00:42:53Z https://community.splunk.com/t5/Getting-Data-In/Discard-log-lines-that-do-not-start-with-a-timestamp/m-p/71177#M14486 <P>Is there a property that would allow me to discard log lines that don't start with a timestamp? I realize that I can nullqueue them based on not matching a pattern, but I thought I remembered seeing something specifically pre-defined for timestamps.</P> <P>Thanks</P> Thu, 31 Mar 2011 00:42:53 GMT https://community.splunk.com/t5/Getting-Data-In/Discard-log-lines-that-do-not-start-with-a-timestamp/m-p/71177#M14486 mslvrstn 2011-03-31T00:42:53Z https://community.splunk.com/t5/Getting-Data-In/Discard-log-lines-that-do-not-start-with-a-timestamp/m-p/71178#M14487 <P>No, there is no special way to handle this other than to use a regex to direct the lines to the null queue.</P> Thu, 31 Mar 2011 03:07:05 GMT https://community.splunk.com/t5/Getting-Data-In/Discard-log-lines-that-do-not-start-with-a-timestamp/m-p/71178#M14487 Stephen_Sorkin 2011-03-31T03:07:05Z