topic Extract a non-strp timstamp across multiple pipe delimiters in Getting Data In

Extract a non-strp timstamp across multiple pipe delimiters

jadamsplunk — Mon, 12 Nov 2018 20:46:56 GMT

Hi everyone,

Given an event like the following, is there a way to get this to successfully parse as _time at index time? I've tried including the pipe in my STRPTIME format but it does not work.

I would think that the following would work, but it has not:

TIME_FORMAT = %H%M%S|%m%d%y

Re: Extract a non-strp timstamp across multiple pipe delimiters

martin_mueller — Mon, 12 Nov 2018 22:53:13 GMT

Make sure you have sensible values for TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD.

Re: Extract a non-strp timstamp across multiple pipe delimiters

FrankVl — Tue, 13 Nov 2018 10:47:48 GMT

^^what he says. Especially if some of those xxx, yyyy may also contain 6 digit numbers...