All Apps and Add-ons

DBX Timestamp Question

treywebb
Explorer

dbx.log:

2014-01-26 23:05:22.515 dbx3011:WARN:ResultSetOutputPayload - Unrecognized timestamp format: '00002249195CF3FC9716E420120309203829.9230-050000'

I've read many of the posts about setting the timestamp and I am still struggling with this seemingly simple issue. I would like to use 20120309203829.9230-050000 from the field above as the timestamp. It seems likes I should be able to configure props.conf to handle this but it escapes me.

Alternatively, I have a field in the same database that is an epoch time field that looks like: 1336672201.000 the issue I have been having using this field is that it doesn't contain the TZ and the TZ can vary per record. There is an additional field in the row that does contain the TZ in the form: 1-040000.

Any suggestions on how to handle this would be greatly appreciated. Thanks!

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Take a sample, use use the data preview to test your timestamp format extraction.

see http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ConfigurePositionalTimestampExtraction

and for the timeformat, http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html

As first sight, Your timestamp TIME_FORMAT looks like "20120309203829.9230-050000"
-> "%Y%m%d%H%M%S.%4N%Z"

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...