More time formatting troubles time_format

onlineops — Mon, 28 Sep 2020 11:27:53 GMT

On the indexer, I have the following property config:
[host::newdatamine]
TIME_PREFIX = ^[INFO|ERROR|WARN]\s+[
TIME_FORMAT = %y.%m.%d\s+%H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]

example logfile:
[INFO] [12.02.27 17:00:24] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog
[INFO] [12.02.27 17:00:42] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-26

Splunk now breaks the lines correctly and picks up the correct date. It does not pick up the correct time:

Splunk output:

1 2/29/12
12:02:29.000 PM

[INFO] [12.02.29 19:00:43] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog

* host=NEWDATAMINE   Options|  
* sourcetype=newdatamine-too_small   Options|  
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log   Options

2 2/29/12
12:02:29.000 PM

[INFO] [12.02.29 15:21:28] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-28

* host=NEWDATAMINE   Options|  
* sourcetype=newdatamine-too_small   Options|  
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log   Options

Re: More time formatting troubles time_format

onlineops — Mon, 28 Sep 2020 11:27:58 GMT

It looks like my mistake was thinking that TIME_FORMAT would do rex (regular expressions). Per docs, it doesn't look like it can... Resolved via the following:

[host::newdatamine]
TIME_PREFIX = ^[[A-Z]+]\s[
TIME_FORMAT = %y.%m.%d %H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]

topic Re: More time formatting troubles time_format in Getting Data In

More time formatting troubles time_format

Re: More time formatting troubles time_format