Help with date Regex

ehoward — Wed, 05 Oct 2016 21:10:44 GMT

The find folks at Fortigate have chosen an "unusual" log format for their URL logs. Pretty simple except for the fact that the Event date is not the first date that Splunk sees. For example here is a sample (sanitized) record in the log:

fort_url|BBOG|MTFCCDF08G|2016-09-25|09:00:00.|1|genkdca-fgat93|url.passthrough|6|TCP|::FFFF:192.168.1.1|53649|53649|::FFFF:135.11.107.20|443|443|52:Information Technology|9-25-2016@08:59:35|msg=URL belongs to an allowed category in policy:|mtfccdf08g-s:mtfccdf08g-n|either|https://fakehost.com

Splunk grabs the recorded date "2016-09-25|09:00:00" fields as the date, but the date I really want recorded as the event time is "9-25-2016@08:59:35" I went into Advance timeStamp extraction settings and entered "%Y-%m-%d@%H%M" as the timestamp format. The place I am stuck is the regex I need to put in for Timestamp prefix. These pipe symbol as the field delimiter is really screwing me up. I really don't know what regex will work as the prefix. Can someone take pity on my and tell me what regex will work?

Thanks!

Re: Help with date Regex

sundareshr — Wed, 05 Oct 2016 21:30:18 GMT

Try this

TIME_FORMAT = %-m-%-d-%Y@%H:%M:%S

Re: Help with date Regex

somesoni2 — Wed, 05 Oct 2016 21:44:17 GMT

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

Re: Help with date Regex

ehoward — Thu, 06 Oct 2016 16:42:32 GMT

Thanks! Just what is was looking for. The TIME_FORMAT worked great with one minor tweak. The '@' did not need to be escaped.

topic Re: Help with date Regex in Getting Data In

Help with date Regex

Re: Help with date Regex

Re: Help with date Regex

Re: Help with date Regex