How to set up time_format in props.conf when only have time

jwalthour — Thu, 23 Jun 2016 15:16:57 GMT

Splunk is indexing a log file that has a format like this:

11:03:51.319 Notify Host: HOST_STATUS_UNKNOWN {279, bdl58056}

The events can also be multi-line. So, I set up the props.conf for this sourcetype like this:

SHOULD_LINEMERGE = true
TIME_PREFIX = \d{2}:\d{2}:\d{2}\.\d{3}\s
TIME_FORMAT = %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 13
BREAK_ONLY_BEFORE_DATE = true

The timestamp doesn't seem to be getting picked up and assigned to _time correctly. How do I set up the event timestamp properly when the "timestamp" on the event is only the time (I can assume the date is the current date)?

Re: How to set up time_format in props.conf when only have time

woodcock — Thu, 23 Jun 2016 23:54:59 GMT

Change this line:

TIME_PREFIX = ^

Re: How to set up time_format in props.conf when only have time

jwalthour — Fri, 24 Jun 2016 15:33:00 GMT

Thank you, woodcock!

topic How to set up time_format in props.conf when only have time in Getting Data In

How to set up time_format in props.conf when only have time

Re: How to set up time_format in props.conf when only have time

Re: How to set up time_format in props.conf when only have time