topic Re: need help in writing time prefix and time format in Getting Data In

need help in writing time prefix and time format

saifuddin9122 — Tue, 23 May 2017 17:11:25 GMT

Hello All

i have events like this:

hn:keng01-dev01-ins01-rpt31.int.dev.mykronos.com|pid:3161|prod:iHub|****4145194752*licensekey.cpp*01640*07000**2017MAY22*09:40:13*
Is PMD Using All CPU cores: Yes
hn:keng01-dev01-ins01-rpt31.int.dev.mykronos.com|pid:3161|prod:iHub|****4145194752*licensekey.cpp*01640*07000*2017MAY22*09:40:13
Is PMD Using All CPU cores: Yes

Can any one help me in writing time prefix and time format for the above events.

Thanks in advance

Re: need help in writing time prefix and time format

skoelpin — Tue, 23 May 2017 17:19:24 GMT

Try this

TIME_FORMAT = %Y%B%d*%I:%M:%S
TIME_PREFIX = \d{4}\w+\d{2}\*\d{2}:\d{2}:\d{2}

Re: need help in writing time prefix and time format

saifuddin9122 — Tue, 23 May 2017 17:47:45 GMT

sorry it didn't worked

Re: need help in writing time prefix and time format

skoelpin — Tue, 23 May 2017 18:34:57 GMT

Which part didn't work and how are you testing this?

Re: need help in writing time prefix and time format

saifuddin9122 — Tue, 23 May 2017 19:03:33 GMT

TIME_PREFIX = \d{4}\w+\d{2}*\d{2}:\d{2}:\d{2}

i'm testing it from add data inputs, when i do it i am seeing timestamp as none

Re: need help in writing time prefix and time format

FloSwiip — Tue, 23 May 2017 19:55:48 GMT

TIME_FORMAT=%Y%B%d*%I:%M:%S
TIME_PREFIX=.*licensekey\.cpp\*\d+\*\d+\*
MAX_TIMESTAMP_LOOKAHEAD=128

works on this sample

Re: need help in writing time prefix and time format

woodcock — Tue, 23 May 2017 22:51:46 GMT

Like this in props.conf:

TIME_PREFIX = ([^\|]*\|){3}(\D+\d+){3}\D+
TIME_FORMAT = %Y%B%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18

Deploy to your Indexers, restart all Splunk instances there and then verify by checking ONLY events that have been forwarded after the restarts.