topic Extract timestamp in db2audit in Getting Data In

Extract timestamp in db2audit

edwardman88 — Mon, 28 Sep 2020 16:47:14 GMT

Hi, I need Splunk to recognize the timestamps down to microseconds.

A sample event is listed below

"2014-06-03-18.30.02.188462","SYSADMIN","DB2AUDIT",2,0,"","dsbdbadm","DSBDBADM",,,"*LOCAL.dsbdbadm.140603103002","db2audit",,,,,,,,,,,,,,,

test]
TIME_PREFIX = ^"
TIME_FORMAT = %Y-%m-%d-%H.%M.%S.%6N

But didn’t work.
Any suggestion?

Thanks.

richgalloway — Wed, 04 Jun 2014 12:03:09 GMT

Have you tried omitting TIME_PREFIX?

somesoni2 — Wed, 04 Jun 2014 13:03:56 GMT

This worked fine with your sample data

[timetest]
SHOULD_LINEMERGE=false
TIME_FORMAT=\"%Y-%m-%d-%H.%M.%S.%6N\"

edwardman88 — Mon, 28 Sep 2020 16:47:45 GMT

I try to change the setting

In the props.conf
[test]
SHOULD_LINEMERGE=false
TIME_FORMAT=\"%Y-%m-%d-%H.%M.%S.%6N\"
In the inputs.conf

[monitor:///audit/03/instance/audit.del]
sourcetype = test
source = sat
index = sat

But splunk still can't get the log

We try delete the microseconds in the audit.del, the splunk can get the log.

Please advise!