topic Re: Time stamp extraction not working in Getting Data In

Time stamp extraction not working

adityapavan18 — Thu, 17 Oct 2013 14:51:31 GMT

I have events which start like

16OCT13 AAAB 12:59:00 JAJAS DKDJD KDD

16OCT13 AABB 13:00:00 AJAJA AKAJK AKA

But i am not able to extract that particular timestamp for events

In my props.conf i used:

SHOULD_LINEMERGE=false

TIME_PREFIX=^

TIME_FORMAT=%d%b%y [A-Z]{4} %H:%M:%S

But doesn't seem to work. Please tell me what i am doing wrong?

Re: Time stamp extraction not working

_d_ — Thu, 17 Oct 2013 17:39:24 GMT

TIME_FORMAT does not accept regexes, only strptime style format

In your case you'd need put the literal AABB string in TIME_FORMAT=%d%b%y AABB %H:%M:%S.

Else, if the string is not known in advance, you'd probably need a custom datetime.xml

Re: Time stamp extraction not working

adityapavan18 — Fri, 18 Oct 2013 07:17:11 GMT

oh ok ...is there any documentation on making changes in datetime.xml

Re: Time stamp extraction not working

kristian_kolb — Fri, 18 Oct 2013 07:25:49 GMT

http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

Re: Time stamp extraction not working

adityapavan18 — Fri, 18 Oct 2013 09:25:57 GMT

I used configuration like

                            <text><![CDATA[(?<![\d\.])([012]\d|3[01])(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(20\d\d|19\d\d|[901]\d(?!\d))\s\w+\s([01]\d|2[0123])\:([0-6]\d)\:([0-6]\d)]]>\s*</text>

            </define>

In data preview it seems to work..but when i configure to read data from files, no data is getting indexed