topic Re: Please provide the time_prefix and time_format for below event type. in Getting Data In

Please provide the time_prefix and time_format for below event type.

lksridhar — Tue, 29 Sep 2020 17:32:09 GMT

Hi folks,

Could you please anyone provide the TIME_PREFIX and TIME_FORMAT for below events type.

10.30.3.247 - - [08/Oct/2017:23:01:00 -0500] "GET /replocator-ws/services/RepDealerLocator?wsdl HTTP/1.1" 200 29638

p_gurav — Tue, 29 Sep 2020 17:36:21 GMT

Hi lksridhar,

TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y %H:%M:%S %z

Before this can you also try increasing value for MAX_TIMESTAMP_LOOKAHED property in props.conf file

mayurr98 — Wed, 10 Jan 2018 13:41:29 GMT

@p_gurav

[<spec>]
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z

there will : instead of space

lksridhar — Tue, 29 Sep 2020 17:32:11 GMT

The above methods is not working and the below format is working

TIME_PREFIX=[
TIME_FORMAT= %d/%b/%Y :%H:%M:%S %-4N

mayurr98 — Wed, 10 Jan 2018 14:49:09 GMT

the sample event that you have mention does not contain space
if it does then you can write

TIME_FORMAT = %d/%b/%Y :%H:%M:%S %z