topic Re: Timestamp Regex need help here! in Splunk Search

Timestamp Regex need help here!

christantoy — Wed, 06 Mar 2013 03:18:34 GMT

Good Day Splunkers

Can you help me to define this in regex format??

Sat Mar  2 01:02:02 2013 +08:00

Thanks in advance

Re: Timestamp Regex need help here!

emiller42 — Wed, 06 Mar 2013 03:40:32 GMT

What are you trying to accomplish here?

Re: Timestamp Regex need help here!

christantoy — Wed, 06 Mar 2013 05:21:23 GMT

To set a new timestamp for my data instead of default splunk timestamp

Re: Timestamp Regex need help here!

yannK — Wed, 06 Mar 2013 05:48:56 GMT

here is what you need : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

for your example, it should look in the sourcetype definition like :
TIMEFORMAT=%a %b %e %H:%M:%S %Y %Z
please try on the data input preview to confirm.

Re: Timestamp Regex need help here!

Ayn — Wed, 06 Mar 2013 08:49:35 GMT

For the record, the format strings you define for parsing timestamps are not regular expressions, they're strptime/strftime format specifiers.

Re: Timestamp Regex need help here!

christantoy — Wed, 06 Mar 2013 09:18:32 GMT

Yes your right Ayn... it's strptime/strime... it working now thanks a lot for the support...

Take care alway....

Re: Timestamp Regex need help here!

lguinn2 — Wed, 06 Mar 2013 09:32:20 GMT

Although I would add "why do you need to specify this?" Splunk is remarkably good at figuring out timestamps and this one is not hard. Splunk really shouldn't need you to specify anything - it can automatically handle this!