topic Re: Pb with sourcetype and date format in Getting Data In

Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 12:02:00 GMT

i have a file with field date like 03/08/2016 09:25 GMT+02:00

My sourcetype doesn't work with
%d/%m/%Y %H:%M %Z%z
\d{2}/\d{2}/\d{4} \d{2}:\d{2} \d{2}:\d{2}

I have Failed to parse timestamp. defaulting to file modtime

Thanks

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 12:59:17 GMT

Do you have any control over how the field is written? Splunk expects offsets in hhmm format rather than hh:mm.

Also, the regex string in your question doesn't match the sample date. Try \d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}

Re: Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 13:20:13 GMT

it doens't work.
the message is :
could not use strptime to parse timestamp from ....
failed to parse timestamp

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 13:31:51 GMT

One does not use regular expressions with strptime. I'm not sure what you're doing with it. I just wanted to point out it doesn't match your data.

Re: Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 14:04:56 GMT

In fact, i want to create a sourcetype to read my file. I selected Advance to define Format timestamp and Prefix timestamp. At this point, i have my parsing error.

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 14:08:35 GMT

That's probably because of the odd timestamp format. Do you have the ability to change it?
I've never seen %Z and %z used together in a format string. Have you tried %d/%m/%Y %H:%M %Z?

Re: Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 14:15:52 GMT

Yes, i have.
It doesn't work too.

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 15:06:07 GMT

That brings us back to my first question, which hasn't been answered.

Can the date format be changed?

Re: Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 15:11:05 GMT

I can't change the date format in the file. 😞
This file is create by nother system and i'm not ability to change it.

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 15:14:30 GMT

Then you may have to use SED within your props.conf file to change the field to a recognized format.

Re: Pb with sourcetype and date format

lefelle — Wed, 03 Aug 2016 15:22:25 GMT

how can do that ?

Re: Pb with sourcetype and date format

richgalloway — Wed, 03 Aug 2016 15:53:45 GMT

In the props.conf stanza for your sourcetype put:

SEDCMD-timestamp=s/\d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}/\1\2\3/g

This should convert the timestamp into %m/%d/%Y %H:%S%Z format.