topic Re: How to limit date timestamp parsing view? in Getting Data In

How to limit date timestamp parsing view?

gbowden_pheaa — Mon, 28 Sep 2020 17:11:20 GMT

I have a proxy server that is double date stamping events. This is not normally an issue, but I ran into a hydridization of these dates when the 2 date stamps differ:

  Jul 27 23:59:59 name01 name01.coname.dom: <Mon, 28 Jul 2014 00:00:00,EDT> xxxpayloadxxx

Splunk date-stamped this event as 7/28/2014 23:59:59. We are utilizing Splunk's default time stamp parsing for this source.

I want Splunk to stop looking for a date after 16 characters. My understanding for the max_timestamp_lookahead in props.conf tells Splunk where to start, not stop.

Any guidance is appreciated. Thanks

Re: How to limit date timestamp parsing view?

martin_mueller — Mon, 28 Jul 2014 15:06:08 GMT

You can specify this:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 16

The prefix tells it where to start, and the lookahead where to stop. Additionally, you could specify an appropriate TIME_FORMAT.

Re: How to limit date timestamp parsing view?

gbowden_pheaa — Mon, 28 Jul 2014 17:36:20 GMT

Awesome - thanks!