topic PROPS Config...Different Time Formats within Same Source File in Splunk Search

PROPS Config...Different Time Formats within Same Source File

SplunkDash — Thu, 12 Aug 2021 19:33:50 GMT

Hello,

I am a source file which has events with 2 different file formats. How would I write TIME_FOMAT for my PROPS Configuration file. any help will be highly appreciated. Thank you..

2021/05/30 16:28:12 JAVA_OPTION_USESERVERCIPHERSUITESORDER:-DuseServerCipherSuitesOrder=true

2021/05/30 16:28:12 JAVA_OPTION_XMX:-Xmx196m

2021-05-30 16:28:27.872 INFO 28709 --- [ main] .c.r.b.i.e.ConsulBootstrapPropertyLoader

2021-05-30 16:28:43.677 INFO 28709 --- [ main] com.sas.studio.ApplicationPetrichor

Re: PROPS Config...Different Time Formats within Same Source File

richgalloway — Thu, 12 Aug 2021 19:53:58 GMT

One cannot have more than one TIME_FORMAT setting for a sourcetype. Sometimes, different time formats means different sourcetypes, but that's not always the case.

If you truly have multiple timestamp formats in the same source type then, first, slap the developer. Ask the admin if timestamp formats are adjustable. Finally, give up on TIME_FORMAT and let the datetime.xml file parse the times for you. It's less than ideal, but probably the best you can do.