Getting time stamps correctly.

Lucas_K — Tue, 01 May 2012 04:14:29 GMT

I'm trying to get a csv file correctly indexed. I can't however seem to get the timestamp props.conf to work correctly.

This is a line of sample data.

A5,2012:04:30:03:48:24,AAAA,1,1,10000,0000,2012:04:30:03:48:24,0711111111,249,1800111111,07111110,,AAAA,0

This is the resulting time stamp.

Incorrect format : 11/12/2010 04:30:03.400
Correct format : 30/04/2012 03:48:24

And these are my config's.

Inputs.conf
[monitor://C:\sampledata.20120430035907.Z]
disabled = false
followTail = 0
host = LOG_HOST
index = MY_LOG
sourcetype = LOG

props.conf
[LOG]
BREAK_ONLY_BEFORE = ^A5,*
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
TIME_FORMAT = %Y:%m:%d:%H:%M:%S
TIME_PREFIX = A5,
pulldown_type = 1
TRANSFORMS-log = log_extractions

[log-extractions]
DELIMS = ","
FIELDS = "field1","field2" etc etc etc

I used the timeprefix to try and get it to detect the first time entry.

The field extraction works fine just not the initial time stamp detection.

Re: Getting time stamps correctly.

Lucas_K — Thu, 03 May 2012 01:22:32 GMT

solved it myself.

Incorrect.
TIME_FORMAT = %Y:%m:%d:%H:%M:%S

Correct.
TIME_FORMAT=%Y:%m:%d:%H:%M:%S

It was literally looking for the white space in each of that statement.

topic Getting time stamps correctly. in Getting Data In

Getting time stamps correctly.

Re: Getting time stamps correctly.