TIME_PREFIX props question

tomjb94 — Fri, 13 Sep 2024 14:38:34 GMT

Hi -

I have a quick props question.

I need to write a props for a particular sourcetype, and the messages always start with before the timestamp starts:

ukdc2-pc-sfn122.test.local - OR ukdc2-pc-sfn121.test.local -

When writing the TIME_PREFIX can a regex be written to account for this, is it just a basic one if so can someone provide this?

Thanks

Re: TIME_PREFIX props question

gcusello — Fri, 13 Sep 2024 15:07:36 GMT

could you share some sample of your logs?

Anyway, if in your logs there's only one timestamp, you could try to use only TIME_FORMAT without TIME_PREFIX.

ciao.

Giuseppe