Time Format Help

rlaan — Tue, 23 Feb 2021 21:39:21 GMT

I am looking for help figuring out how to represent the following timestamp as a prefix for parsing time/start of events. this is contained in some logs i was provided today and am having difficulty figuring out how to get pas the "o'clock" contained within the log files. these are new logs that were indexed under an existing sourcetype that already had a working/existing timestamp format.

Old format: (majority of logs)
[2021-02-23T14:37:26.659-07:00]

New/abnormal format: (some weird new stuff)
<23-Feb-2021 2:21:41 o'clock PM MST>

I am trying to figure out how best to capture the new format logs from the existing sourcetype and redirect them into the proper timestamp configuration or a new sourcetype of their own.

Re: Time Format Help

scelikok — Wed, 24 Feb 2021 04:27:34 GMT

Hi @rlaan,

You can use below time format;

TIME_PREFIX = < TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z

topic Time Format Help in Getting Data In

Time Format Help

Re: Time Format Help