topic Re: Parsing time failing in Getting Data In

Parsing time failing

Sqig — Mon, 11 Jul 2011 18:39:05 GMT

Hi. I have done a good amount of reading on this, and it seems to be a popular subject both in the documentation and on the Answers site. Still, I'm rather stumped.

We have logs where each line starts with a date/time stamp in the format

YYYYmmdd HHMMSS hostname lots of other data

20110711 145022 myhost yadda yadda yadda

Splunk combines as many of these lines into one event as it can. We have tried adding the following to Props.conf on the Indexers but have had no success.

TIME_FORMAT = %Y%m%d %H%M%S
TZ = US/Eastern
MAX_EVENTS=1
SHOULD_LINEMERGE = false

Also tried TIME_FORMAT = ^%Y%m%d %H%M%S

Is this likely just a regex problem?

Other elements of the props.conf stanza are honored and acted upon when the data is indexed.

Given the simplicity of the timestamp and its presence at the very beginning of the line, I would think this would be easy to solve. Do we need to look at a custom datetime.xml file?

Thanks for any guidance.

Re: Parsing time failing

ccannon1 — Mon, 11 Jul 2011 18:54:23 GMT

Try adding a TIME_PREFIX element which tells Splunk where to look for the time.

TIME_PREFIX = ^
TIME_FORMAT = %Y%m%d %H%M%S

Re: Parsing time failing

Sqig — Mon, 11 Jul 2011 20:01:24 GMT

Thanks for the suggestion. At first, I thought this worked (!!) but a closer look showed that I was seeing additional results not related to the logs in quesiton.

When restricting my search properly, I'm still seeing the same problem I was before.

Re: Parsing time failing

gkanapathy — Mon, 11 Jul 2011 20:06:22 GMT

Your properties look right. I suppose I would question and check whether they are being applied to the incoming data.

Re: Parsing time failing

Sqig — Mon, 11 Jul 2011 21:44:28 GMT

btool shows that the parameters described above are, in fact, being applied. I don't know of anything else I can check.