topic Re: Date / time format (regex help) in Splunk Search

Date / time format (regex help)

zebu14 — Tue, 15 Jul 2014 13:59:30 GMT

Hello,

My log files looks like this :

"1","I","R","140406 233102","E","0","1341874",[...]

I want Splunk to recognize the date and time from this log.

The date uses the following format : "YYMMDD HHMMSS"
("140406 233102" ==> 2014 June 6th, 23h31m02s)

Can someone help me to find the regex ?

Thanks

martin_mueller — Tue, 15 Jul 2014 14:03:52 GMT

You'll want to set these in props.conf:

[your_sourcetype]
TIME_PREFIX = ","
MAX_TIMESTAMP_LOOKAHEAD = 14
TIME_FORMAT = %y%m%d %H%M%S

Depending on the rest of your sourcetype's special needs there may be more to set, but this should take care of your timestamp.

somesoni2 — Tue, 15 Jul 2014 14:08:25 GMT

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1

zebu14 — Tue, 15 Jul 2014 14:08:52 GMT

I'll try it as soon as possible.
Thanks !

zebu14 — Wed, 16 Jul 2014 07:05:28 GMT

This one worked for me.

Thank you !