topic Re: Timestamp configuration does not pull the correct timestamp in Getting Data In

Timestamp configuration does not pull the correct timestamp

iherre312 — Thu, 24 Sep 2015 16:38:05 GMT

I am importing cisco logs that have two timestamps with different formats.
Unfortunately, configuration set in props.conf for the app is still not pulling extracting the correct date.
Here is a sample:

<splunk system timestamp> Aug 23 12:00:00 xxxx.org: <second timestamp> 2016 Sept 28 12:34:53 EDT

[test]
TIME_PREFIX = org :\s*
#TIME_FORMAT = %Y %b %d %H:%M:%S %Z
MAX_TIMESTAMP_LOOKAHEAD = 75

Re: Timestamp configuration does not pull the correct timestamp

lguinn2 — Thu, 24 Sep 2015 17:18:55 GMT

Looks like there is a space between "org" and ":" in your props.conf TIME_PREFIX, but not in your data.

Re: Timestamp configuration does not pull the correct timestamp

alacercogitatus — Thu, 24 Sep 2015 17:43:13 GMT

It seems to me, you do not need the TIME_PREFIX option, since the format of the different fields is, well, different.

You do want to use the TIME_FORMAT setting, which does look correct.

The TIME_PREFIX listed in your config would not work, due to the space in between the org and the :. You can correct the TIME_PREFIX , and your input should start working.

Re: Timestamp configuration does not pull the correct timestamp

alacercogitatus — Wed, 30 Sep 2015 14:35:59 GMT

Please accept either answer if we have answered your question. Thanks!