topic Re: hour component of timestamp ignored, because there is no minute component in Getting Data In

hour component of timestamp ignored, because there is no minute component

imrago — Thu, 04 Jul 2013 10:09:27 GMT

I would like to extract this timestamp:

2013-07-03,8

with

%Y-%m-%d,%H

but I am unable to that because:
If <strptime-style format> contains an hour component, but no minute component, TIME_FORMAT ignores the hour component. It treats the format as an anomaly and considers the precision to be date-only. Splunk Docs

How could I disable that feature?

Re: hour component of timestamp ignored, because there is no minute component

chimbudp — Mon, 28 Sep 2020 14:15:10 GMT

You can use REGEX , in this case :
You may need to edit the props.conf

BREAK_ONLY_BEFORE =
* When set, Splunk creates a new event only if it encounters a new line that matches the
regular expression.
* Defaults to empty.

MUST_BREAK_AFTER =
* When set and the regular expression matches the current line, Splunk creates a new event for
the next input line.
* Splunk may still break before the current line if another rule matches.
* Defaults to empty.

MUST_NOT_BREAK_AFTER =
* When set and the current line matches the regular expression, Splunk does not break on any
subsequent lines until the MUST_BREAK_AFTER expression matches.
* Defaults to empty.

MUST_NOT_BREAK_BEFORE =
* When set and the current line matches the regular expression, Splunk does not break the
last event before the current line.
* Defaults to empty.
* List item

Re: hour component of timestamp ignored, because there is no minute component

chimbudp — Thu, 04 Jul 2013 10:38:14 GMT

This site may be helpful in creating regex :
http://gskinner.com/RegExr/

Re: hour component of timestamp ignored, because there is no minute component

imrago — Thu, 04 Jul 2013 10:45:13 GMT

The line breaking is working fine and Splunk is finding the timestamps.

The problem is that only the date part is used.