Splunk Search

Index Event Properly

shangshin
Builder

Hi,
The event in my Log always has a prefix yyyy-MM-dd hh:mm:ss,SSS e.g. 2013-07-30 07:12:11,649
To have the event indexed properly, can I use the line below in props.conf

   BREAK_ONLY_BEFORE=yyyy-MM-dd hh:mm:ss,SSS

Thanks for the advice!

Tags (1)
0 Karma
1 Solution

mloven_splunk
Splunk Employee
Splunk Employee

Nope. You're (kinda) mixing up BREAK_ONLY_BEFORE and TIME_FORMAT.

BREAK_ONLY_BEFORE is a regex field. Use something like:

BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

View solution in original post

mloven_splunk
Splunk Employee
Splunk Employee

Nope. You're (kinda) mixing up BREAK_ONLY_BEFORE and TIME_FORMAT.

BREAK_ONLY_BEFORE is a regex field. Use something like:

BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

shangshin
Builder

Thank you for the useful answer.

0 Karma

shangshin
Builder

or
BREAK_ONLY_BEFORE=/d/d/d/d-/d/d-/d/d/ /d/d:/d/d:/d/d

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...