topic Re: Remove square brackets from timestamp in Splunk Search

Remove square brackets from timestamp

jbesant — Thu, 04 Feb 2021 13:09:02 GMT

Hi, hoping someone can help with this as its been a while since I used Splunk and I can't seem to figure this out!

I'm trying to import a csv that has a field with a time format of:

[20210102] 06:58.10

I have tried TIME_FORMAT=%Y%m%d %H:%M.%S

and I get a _time field that is correct except it doesn't show the seconds. the above is returned as 02/01/2021 06:58:00

I'm pretty sure its to do with the way the square brackets are being interpreted but can't seem to work out how to ignore them. Adding them into the TIME_FORMAT string doesn't help.

Thanks.

Re: Remove square brackets from timestamp

richgalloway — Thu, 04 Feb 2021 13:27:11 GMT

Include the brackets in the time format

TIME_PREFIX = \[ TIME_FORMAT = %Y%m%d] %H:%M.%S

Re: Remove square brackets from timestamp

jbesant — Thu, 04 Feb 2021 13:48:49 GMT

No, sorry, that doesn't work. I also tried TIME_PREFIX=^\[

Re: Remove square brackets from timestamp

richgalloway — Thu, 04 Feb 2021 19:07:49 GMT

How are you testing it? If you're editing a props.conf file then be sure to restart Splunk afterwards. Also, make sure to edit the correct file.

You know the settings only apply to new data, right?

Re: Remove square brackets from timestamp

jbesant — Fri, 05 Feb 2021 11:23:44 GMT

Many thanks, forgot to do the restart.