topic Re: Need help on TIME_FORMAT and TIME_PREFIX in Getting Data In

Need help on TIME_FORMAT and TIME_PREFIX

sathiyasun — Tue, 29 Sep 2020 21:02:27 GMT

I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help.

Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime)

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true

Re: Need help on TIME_FORMAT and TIME_PREFIX

harsmarvania57 — Tue, 28 Aug 2018 12:23:55 GMT

Hi @sathiyasun,

What is the timestamp in your sample data :2018-08-27 14:28:06,382 OR 2018-08-27 14:28:15,000?

Re: Need help on TIME_FORMAT and TIME_PREFIX

richgalloway — Tue, 28 Aug 2018 12:33:27 GMT

I think you need TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N.
The TIME_PREFIX setting should not be "\s" as none of the timestamps in your sample event are preceded by a space. Perhaps TIME_PREFIX = : will work.

Re: Need help on TIME_FORMAT and TIME_PREFIX

sathiyasun — Tue, 28 Aug 2018 14:40:08 GMT

This is the date &timestamp
DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382

Re: Need help on TIME_FORMAT and TIME_PREFIX

mstjohn_splunk — Tue, 28 Aug 2018 21:47:27 GMT

hi @sathiyasun,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!!

Re: Need help on TIME_FORMAT and TIME_PREFIX

harsmarvania57 — Thu, 30 Aug 2018 13:55:52 GMT

I am assuming that you have multi line events in that case please try with TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N , TIME_PREFIX = ^(?s)(?:[^\:]*\:){2} and SHOULD_LINEMERGE = true in props.conf on Indexer or Heavy forwarder whichever comes first from UF.