topic Re: Properly Extract Time from custom Data Set in Getting Data In

Properly Extract Time from custom Data Set

hagjos43 — Thu, 01 Oct 2015 13:51:32 GMT

Hello, I have the follow data set comprised of custom weblog output:

2015-08-08 12:40:03:163 UserID="37" userGroup="helloworld1192" userRole="test82" commonName="insertnamehereagainandagain" certName="HENRY.T.WASHINGTON" ipAddress="192.168.1.83" userBrowser="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"

I have the following in my Props.conf on the indexer:

[customwebtest]
LINE_BREAKER = (\d{4}\S\d{2}\S\d{2}\s\d{2}\S\d{2}\S\d{2}\S\d{3})
SHOULD_LINEMERGE = false
CHECK_FOR_HEADER = false
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = ^
TIME_FORMAT = (%y-%m-%d %H:%M:%S:%3N)

Problem is in Splunk it's excluding the event timestamp and using the time at ingestion. What am I doing wrong here?

Thanks!

Re: Properly Extract Time from custom Data Set

pradeepkumarg — Thu, 01 Oct 2015 13:58:56 GMT

Your time format is wrong. It should be uppercase Y for the year if it includes centuary

 TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Commontimeformatvariables

Re: Properly Extract Time from custom Data Set

richgalloway — Tue, 29 Sep 2020 07:27:20 GMT

The value of the LINE_BREAKER attribute is the event separator - characters that come between events. Whatever matches the first capturing group is discarded. If your log has one event per line then the default LINE_BREAKER=\n should be sufficient.

Re: Properly Extract Time from custom Data Set

schose — Thu, 01 Oct 2015 14:06:22 GMT

Remove your LINE_BREAKER and you should be fine.

Cheers,

Andreas