topic Re: TimeStamp problem in Getting Data In

TimeStamp problem

geantvert007 — Fri, 15 Jan 2016 11:00:16 GMT

Hi,

I have a timestamp problem on Splunk.
I am working with log file who looks like :

numberline;date;ipsrc;ipdst
102;13Jan2015;10.10.10.10;12.12.12.12

On splunk the date is 15 january but on the raw date we are in 13 january ...
I know that I have to configure propers.config,date_time.xml ect but what is the command to extract the date without space correctly ?

Thanks

Steve

Re: TimeStamp problem

renjith_nair — Fri, 15 Jan 2016 13:56:12 GMT

If you are trying to extract the date from your event, ie 13Jan2015, you can use

[<spec>]
TIME_PREFIX = \d{3};
TIME_FORMAT = %d%b%Y

where spec can be host,source,sourcetype

Reference : http://docs.splunk.com/Documentation/Splunk/6.1/Data/Configuretimestamprecognition

Re: TimeStamp problem

geantvert007 — Fri, 15 Jan 2016 14:18:37 GMT

Thanks renjith.nair,
I will try this.

On the splunk document they talk about the props.conf but I have use the local or the default props.config to enable the extraction ?

Re: TimeStamp problem

renjith_nair — Fri, 15 Jan 2016 15:32:13 GMT

For all your configuration, use local. Also please not that you might need to adjust the time prefix regex to match all your events