topic Re: How do I extract the time from Operating System events? in Splunk Search

How do I extract the time from Operating System events?

scottrunyon — Tue, 29 Sep 2020 19:01:22 GMT

I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP every 15 minutes. Splunk is setting _time as the download time, not the time of the event.

This is the format of the message -

I have tried the following

TIMESTAMP_FIELDS = rt
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%z
TIME_PREFIX = rt=
MAX_TIMESTAMP_LOOKAHEAD = 160

What am I missing?

Re: How do I extract the time from Operating System events?

p_gurav — Thu, 12 Apr 2018 13:18:57 GMT

Did you try increasing value for MAX_TIMESTAMP_LOOKAHEAD ?

Re: How do I extract the time from Operating System events?

scottrunyon — Thu, 12 Apr 2018 13:27:59 GMT

Yes, it was 128 to start.

Re: How do I extract the time from Operating System events?

gcusello — Thu, 12 Apr 2018 13:45:57 GMT

Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex

TIME_PREFIX = rt\=

and

MAX_TIMESTAMP_LOOKAHEAD = 31

and I shouldn't use

TIMESTAMP_FIELDS = rt

Bye.
Giuseppe

Re: How do I extract the time from Operating System events?

scottrunyon — Thu, 12 Apr 2018 14:16:08 GMT

That did not work. The events are showing Time as the download time.

Re: How do I extract the time from Operating System events?

gcusello — Thu, 12 Apr 2018 14:23:09 GMT

Hi scottrunyon,
do you receive these logs on Indexer or on Heavy Forwarder?
where is this props.conf?
It must be on the same server that receive logs.

Bye.
Giuseppe

Re: How do I extract the time from Operating System events?

p_gurav — Thu, 12 Apr 2018 14:23:46 GMT

Did you try :

TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
TIME_PREFIX = \|rt\=
MAX_TIMESTAMP_LOOKAHEAD = 160

Re: How do I extract the time from Operating System events?

scottrunyon — Thu, 12 Apr 2018 14:27:14 GMT

It is received on the indexer. I have a single instance and props.conf is under \search\local.

Re: How do I extract the time from Operating System events?

gcusello — Thu, 12 Apr 2018 14:37:09 GMT

if you have timezone GMT+00:00, you have to use %:z, try:

TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z

Bye.
Giuseppe

Re: How do I extract the time from Operating System events?

scottrunyon — Thu, 12 Apr 2018 15:00:51 GMT

That didn't work It looks like it is pulling the time from the first part of the event.

Re: How do I extract the time from Operating System events?

scottrunyon — Thu, 12 Apr 2018 15:57:18 GMT

I am doing these changes through the "Source Type" web interface, which updates props.conf when saved. Do I have to a restart of Splunk to get the changes to take?

I am running on a Windows server.

Re: How do I extract the time from Operating System events?

scottrunyon — Fri, 13 Apr 2018 13:09:43 GMT

I did a restart this morning and the time is what I need it to be.

Thanks for the help.

Scott