topic Re: Timestamp extraction props.conf in Getting Data In

Timestamp extraction props.conf

aaronkorn — Fri, 18 Jan 2013 19:18:36 GMT

Hello,

We have the following timestamp in our log but are unsure how to edit the props.conf to pick it up:

The format is MM/DD HH:MM YY

IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION
AA8AB241 0115010113 T O OPERATOR OPERATOR NOTIFICATION
BF05CF18 0115010013 I H pt3rmt04079 AAA5
BF05CF18 0115010013 I H pt3rmt04074 AAA5
BF05CF18 0115010013 I H pt3rmt04071 AAA5
BF05CF18 0115010013 I H pt3rmt04055 AAA5
BF05CF18 0115010013 I H pt3rmt04050 AAA5
BF05CF18 0115010013 I H pt3rmt04049 AAA5
BF05CF18 0115010013 I H pt3rmt04042 AAA5
BF05CF18 0115010013 I H pt3rmt04038 AAA5
BF05CF18 0115010013 I H pt3rmt04031 AAA5
BF05CF18 0115010013 I H pt3rmt04030 AAA5

Re: Timestamp extraction props.conf

martin_mueller — Sat, 19 Jan 2013 16:50:37 GMT

You may be looking for this:

TIME_FORMAT=%m%d%H%M%S
TIME_PREFIX=^\S+\s+

Note, the prefix may be wrong for other types of data you have. It just skips over the first word.

Re: Timestamp extraction props.conf

aaronkorn — Sat, 19 Jan 2013 17:40:02 GMT

This didnt seem to do it.

Re: Timestamp extraction props.conf

martin_mueller — Sun, 20 Jan 2013 12:41:44 GMT

Works for me when taking your sample data into the data inputs preview.