DBX Timestamp Question

[treywebb]

dbx.log:

2014-01-26 23:05:22.515 dbx3011:WARN:ResultSetOutputPayload - Unrecognized timestamp format: '00002249195CF3FC9716E420120309203829.9230-050000'

I've read many of the posts about setting the timestamp and I am still struggling with this seemingly simple issue. I would like to use 20120309203829.9230-050000 from the field above as the timestamp. It seems likes I should be able to configure props.conf to handle this but it escapes me.

Alternatively, I have a field in the same database that is an epoch time field that looks like: 1336672201.000 the issue I have been having using this field is that it doesn't contain the TZ and the TZ can vary per record. There is an additional field in the row that does contain the TZ in the form: 1-040000.

Any suggestions on how to handle this would be greatly appreciated. Thanks!

[yannK]

Take a sample, use use the data preview to test your timestamp format extraction.

see http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ConfigurePositionalTimestampExtraction

and for the timeformat, http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html

As first sight, Your timestamp TIME_FORMAT looks like "20120309203829.9230-050000"
-> "%Y%m%d%H%M%S.%4N%Z"