topic Re: How to update props.conf to extract timestamp from my sample data? in Getting Data In

How to update props.conf to extract timestamp from my sample data?

sravankaripe — Tue, 29 Sep 2020 11:42:27 GMT

Please help me with props.conf file i have sample data below i want to extract time stamp from the below sample data.

BREAK_ONLY_BEFORE=
TIME_PREFIX=
TIME_FORMAT=

10.123.123.12 - - [02/Nov/2016:00:36:31 -0500] "POST /comp/apps/services/api/comp/iphone/init HTTP/1.1" 123 12345 1234 WAS=abc-abcdef12-xzy12.maps.ib:1234 TMS=12345 T=0 "-" "comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00),comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00)/somexzyAPI/7.0.0.0" "-" JSessionID=1234aLpYQEcNOxbnZeE7eCMv5zO:mfp-wlprod12-abc01-MfpProdSrv12 "-"

Re: How to update props.conf to extract timestamp from my sample data?

skoelpin — Mon, 07 Nov 2016 16:56:15 GMT

Try this

[YOUR_SOURCETYPE]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,$3N

Re: How to update props.conf to extract timestamp from my sample data?

somesoni2 — Mon, 07 Nov 2016 16:57:25 GMT

Try this for your sourcetype definition/props.conf

[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d+\.\d+\.\d+\.\d+\s+)
TIME_PREFIX = ^(\S+\s+){3}\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
MAX_TIMESTAMP_LOOKAHEAD = 26

Re: How to update props.conf to extract timestamp from my sample data?

dbcase — Mon, 07 Nov 2016 17:00:47 GMT

I had the same question just last week. Somesoni2's answer worked for me 🙂

Re: How to update props.conf to extract timestamp from my sample data?

dmaislin_splunk — Mon, 07 Nov 2016 17:00:48 GMT

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
MAX_TIMESTAMP_LOOKAHEAD=26
CHARSET=UTF-8

Re: How to update props.conf to extract timestamp from my sample data?

sravankaripe — Mon, 07 Nov 2016 17:03:33 GMT

thanks its working

Re: How to update props.conf to extract timestamp from my sample data?

sravankaripe — Mon, 07 Nov 2016 17:21:15 GMT

thanks sir this is also working.