topic Re: Help with TIME_PREFIX in Splunk Search

Help with TIME_PREFIX

a212830 — Mon, 06 Apr 2015 13:37:52 GMT

Hi,

I need some help setting up a TIME_PREFIX for the following:

INFO | jvm 1 | 2015/04/05 01:56:20 | Sametime Check: Sametime Session unloaded
INFO | jvm 1 | 2015/04/05 01:56:22 | Sametime Check: Slave thread complete; Stats:
INFO | jvm 1 | 2015/04/05 01:56:22 |

Can someone help me?

TIA.

Re: Help with TIME_PREFIX

gfuente — Mon, 06 Apr 2015 13:39:33 GMT

Hello

You can use this regex:

^[^\|]*\|[^\|]*\|\s*

regards

Re: Help with TIME_PREFIX

a212830 — Mon, 28 Sep 2020 19:25:41 GMT

Thanks. Doesn't seem to work. Still getting "could not use strptime to parse timestamp..." messages.

Here's my entire props.conf:

ANNOTATE_PUNCT = false
KV_MODE = auto
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 90
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_PREFIX = ^[^|]|[^|]|\s*
TIME_FORMAT = %Y/%M/%d %H:%M:%S

Re: Help with TIME_PREFIX

gfuente — Mon, 06 Apr 2015 13:58:12 GMT

Your time format is wrong, you should use:

%Y/%m/%d %H:%M:%S

Re: Help with TIME_PREFIX

a212830 — Mon, 06 Apr 2015 14:12:54 GMT

Grrr. Stupid me.

Thanks!