topic edit sourcetype settings? in Getting Data In

edit sourcetype settings?

bellaed — Tue, 05 Feb 2013 12:51:34 GMT

when i created my sourcetype my-log i selected default timestamp, later i found out that in some events with more than one line, certaing timestamps are there. and because of these timestamps those events are considered seperately.
the mistake i did is while creating sourcetype i didn't check out the option
Format with a checkbox to Specify timestampformat (strptime)ex; %Y-%m-%d
if i check that option and give the format of the timestamp which is always at the beginning of the event i am able to get the correct event formats, now how to change it as i already crreated sourcetypes and indexed files ..
Thanks Bella

Re: edit sourcetype settings?

martin_mueller — Tue, 05 Feb 2013 15:51:09 GMT

For the sourcetype, edit props.conf. That won't affect already indexed events though, those need to be re-indexed.

Re: edit sourcetype settings?

bellaed — Wed, 06 Feb 2013 12:16:20 GMT

If this is the time specified in the log
2013-01-22 17:43:32
will TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf is enough?
But still not able to read the _time,even for the newly indexed logs..
it displays date correctly but time is default to 12:00:00.000 AM for every log events

Re: edit sourcetype settings?

martin_mueller — Wed, 06 Feb 2013 12:30:24 GMT

Depending on your specific logs you may need to specify other timestamp configuration such as prefixes: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

Re: edit sourcetype settings?

smolcj — Wed, 06 Feb 2013 12:55:36 GMT

log starts with the timestamp but there are time in between which specifies some time point or earlier event happened time etc, splunk will read in between time and take those events as separate events
so give some prefixes for timestamps

Re: edit sourcetype settings?

bellaed — Thu, 07 Feb 2013 07:10:48 GMT

As i already stated, there isn't anything before the time. Events should start with time.
Providing sample events for more clarification:
2012-10-24 15:39:48 : INFO :Num CPUs = 12
2012-10-24 15:39:48 : INFO :Pentium processor
2012-10-24 15:39:48 : INFO :nifaces = 5
2012-10-24 15:39:48 : INFO :iface name [lo]
2012-10-24 15:39:48 : INFO :checking..
license checking started
checking started at 24/10/2012 15:39:48
license field: [Product][blabla]
[certain numbers]:
license field: [Chicago Trading]
[key]:
license field: [Expiration-Date][never]
[key]:
license field: [License-Key][pdct key]

license parsed key [secretkey]

Time in the event in bold is considered as new event. Actually it is the continuation of previous event. How to skip reading second timestamp?

Re: edit sourcetype settings?

martin_mueller — Thu, 07 Feb 2013 08:09:31 GMT

Based on the example from your non-answer, try this setting in props.conf under your sourcetype:

MAX_TIMESTAMP_LOOKAHEAD=20

Using only that, the remaining default values give me one event per row at first, and one long event starting with the "checking.." row.