topic Re: Timezone in Getting Data In

Timezone

uagraw01 — Tue, 14 Jul 2020 17:09:48 GMT

My logs are that kind :

So i used TIME_FORMAT=%b %d, %Y %H:%M:%S, %3N%p%z

But it is not parsing and showing me error that " could not use strptime to parse timestamp from "july 13, 2020 10:52:03,907 PM CDT>

Please let me know how to solve this issue.

Re: Timezone

richgalloway — Tue, 14 Jul 2020 17:47:10 GMT

Spacing is critical. Make sure the sample data matches the format string.

TIME_FORMAT=%b %d, %Y %H:%M:%S,%3N %p %Z

Re: Timezone

uagraw01 — Tue, 14 Jul 2020 17:42:07 GMT

@richgalloway Above is the error. Please help me how to fix this one.

Re: Timezone

richgalloway — Tue, 14 Jul 2020 17:47:44 GMT

I got the time zone decoder wrong. Try my updated reply.

Re: Timezone

uagraw01 — Tue, 14 Jul 2020 18:03:35 GMT

@richgalloway I will try and let you know.

Re: Timezone

uagraw01 — Wed, 15 Jul 2020 08:14:11 GMT

@richgalloway Still showing the same error. Please let me know to fix this.

Re: Timezone

faizancool85 — Wed, 15 Jul 2020 08:35:13 GMT

You can try adding TIME_PREFIX = \<

Re: Timezone

uagraw01 — Wed, 15 Jul 2020 09:20:20 GMT

@faizancool85 yes added but still not working. But when i remove TIME_FORMAT completely and use only LINE_BREAKER=\w{3}\s\d{2},\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{2}\s\w{3}

It is perfectly parsed. But i want to use time format also. Please let me know what is the reason that not get parsed or showing the above error as mentioned earlier.

Re: Timezone

faizancool85 — Wed, 15 Jul 2020 09:45:58 GMT

@uagraw01 Can you paste here a sample data?

Re: Timezone

uagraw01 — Wed, 15 Jul 2020 09:57:00 GMT

@faizancool85 The same error which i pasted earlier.

Re: Timezone

faizancool85 — Wed, 15 Jul 2020 10:08:38 GMT

Looks like you're missing an Index-time setting, It's highly recommended to define below 6 index-time settings whenever your onboarding new data sources. I believe you're missing these. Try to define with this to solve the issue.

TIME_PREFIX
TIME_FORMAT
MAX_TIMESTAMP_LOOKAHEAD
LINE_BREAKER
SHOULD_LINEMERGE
TRUNCATE

Re: Timezone

uagraw01 — Wed, 15 Jul 2020 10:50:00 GMT

@faizancool85 i used all these six settings but when i used TIME_FORMAT the above error is showing to me.

Re: Timezone

richgalloway — Wed, 15 Jul 2020 12:28:59 GMT

A screen shot is not sample data. Sample data is something we can paste into our own Splunk instances to test possible solutions.

Re: Timezone

uagraw01 — Wed, 15 Jul 2020 12:35:00 GMT

<July 13, 2020 10:55:02,572 PM CDT> <Error> <oracle.oam.binding> <OAM-00002> <Error occurred while handling the request.

This is the sample log.

Re: Timezone

richgalloway — Wed, 15 Jul 2020 15:52:27 GMT

Thanks for the sample. It works on my system using the settings we've discussed.
I find it interesting that an error is displayed even though the timestamps are interpreted correctly.

Re: Timezone

uagraw01 — Sat, 18 Jul 2020 13:36:40 GMT

@richgalloway Yes same thing happened from my side. It is parsed but same error is displayed.

Re: Timezone

to4kawa — Sun, 19 Jul 2020 02:16:55 GMT

You don't need extra Time setting on props.conf

Splunk can extract timestamps

[ your sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=AUTO
TRANSFORMS-your_setting = your_setting