How to ask splunk to extract time_stamp only if time string is at the start of a line?

houxiaoxiao — Thu, 18 Aug 2011 04:18:36 GMT

I tried to put the "TIME_PREFIX = ^" at props.conf at system/default, system/local, myapp/default, myapp/local but none of them is working. What should I do?

Re: How to ask splunk to extract time_stamp only if time string is at the start of a line?

bbingham — Thu, 18 Aug 2011 04:39:32 GMT

I think you may need to add more to your solution. By default, splunk will already will start looking at the start of a line for the timestamp. I think what you may be looking for will be achieved by using MAX_TIMESTAMP_LOOKAHEAD in conjunction with what you have. By default splunk looks from the start of a line, then looks up to 150 char in the event for a timestamp. By adjusting MAX_TIMESTAMP_LOOKAHEAD, you can control how far into an event splunk looks for the timestamp. If you use something like the following:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 10

Splunk will start on the first character, and count up to 10 more characters for a timestamp. Adjust your MAX_TIMESTAMP_LOOKAHEAD to fit your timestamp syntax and splunk will be forced to match your timestamp at the start of the line.

Hope that helps

topic How to ask splunk to extract time_stamp only if time string is at the start of a line? in Getting Data In

How to ask splunk to extract time_stamp only if time string is at the start of a line?

Re: How to ask splunk to extract time_stamp only if time string is at the start of a line?