https://community.splunk.com/t5/Getting-Data-In/websphere-startup-entries/m-p/155041#M31512 <P>Hi,</P> <P>I have a SystemOut.log from Websphere that needs to be indexed in Splunk. These logs all start with environmental information without a date, that I want to ignore. What's the best way to approach this? </P> <P>The logfile starts with:</P> <P>************ Start Display Current Environment ************<BR /> bunch of text without timestamps...<BR /> ************* End Display Current Environment *************<BR /> [7/23/14 15:20:39:124 EDT] 00000056 SystemOut O Question Text is: When will withdrawals begin?<BR /> ......</P> <P>Also, I'm having issues with the timestamps. I have the following, but it's not working:</P> <PRE><CODE>MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = 1 TIME_FORMAT= %m/%d/%y %H:%M:%S:%3N %Z TIME_PREFIX = ^[ TRUNCATE = 999999 SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\[\d{1-2}-\d{2}-\d{2} KV_MODE=auto ANNOTATE_PUNCT = false </CODE></PRE> Wed, 23 Jul 2014 19:56:37 GMT a212830 2014-07-23T19:56:37Z https://community.splunk.com/t5/Getting-Data-In/websphere-startup-entries/m-p/155041#M31512 <P>Hi,</P> <P>I have a SystemOut.log from Websphere that needs to be indexed in Splunk. These logs all start with environmental information without a date, that I want to ignore. What's the best way to approach this? </P> <P>The logfile starts with:</P> <P>************ Start Display Current Environment ************<BR /> bunch of text without timestamps...<BR /> ************* End Display Current Environment *************<BR /> [7/23/14 15:20:39:124 EDT] 00000056 SystemOut O Question Text is: When will withdrawals begin?<BR /> ......</P> <P>Also, I'm having issues with the timestamps. I have the following, but it's not working:</P> <PRE><CODE>MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = 1 TIME_FORMAT= %m/%d/%y %H:%M:%S:%3N %Z TIME_PREFIX = ^[ TRUNCATE = 999999 SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\[\d{1-2}-\d{2}-\d{2} KV_MODE=auto ANNOTATE_PUNCT = false </CODE></PRE> Wed, 23 Jul 2014 19:56:37 GMT https://community.splunk.com/t5/Getting-Data-In/websphere-startup-entries/m-p/155041#M31512 a212830 2014-07-23T19:56:37Z https://community.splunk.com/t5/Getting-Data-In/websphere-startup-entries/m-p/155042#M31513 <P>IBM's WebSphere is not exactly keen in sticking to the logging protocol, eh? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> I heard a lot of splunk developers complaining about this at splunk.conf last year. <BR /> Anyway, luckily they solved it for us, with the sourcetype: "websphere_trlog_sysout". It handles the long headers and timestamps out of the box. </P> Mon, 28 Sep 2020 17:09:43 GMT https://community.splunk.com/t5/Getting-Data-In/websphere-startup-entries/m-p/155042#M31513 renems 2020-09-28T17:09:43Z