topic Re: Time stamp separated by a tab in Getting Data In

Time stamp separated by a tab

silvermail — Fri, 13 Aug 2010 11:26:16 GMT

Hello guys,

Been trying to get this to work but to no avail...

I have a CSV file that goes like this:

pid hostname c1 c2 c3 status date time message
123456 serverA 0 0 0 54058938 20100301 033412 Error with Transfer

I am trying to parse the fields date and time and I have specified something like this in my props.conf

TIME_PREFIX = \w+\s\w+\s\w+\s\w+\s\w+\s\w+\s
TIME_FORMAT = %Y%m%d %H%M%S

But I couldn't get the date/time indexed correctly.

But if I change my original log source to be 20100301033412 (without the space in-between), it works fine.

Has anyone solved this before? Any response is much appreciated. Thanks.

Re: Time stamp separated by a tab

silvermail — Fri, 13 Aug 2010 11:43:26 GMT

Ah, got it.

It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S (with a tab and not a space as the CSV is using tab delimeter).

Re: Time stamp separated by a tab

gkanapathy — Wed, 18 Aug 2010 23:28:51 GMT

I believe you can use %t in the time formats to represent any white space, including a tab character. I am not sure if \t would work specifically for a tab character, but there is a good chance it will.

Re: Time stamp separated by a tab

silvermail — Thu, 19 Aug 2010 07:34:28 GMT

I did use \t and I believe it will work as well. Will try %t next time if I run into any issues. Thanks!