Archive

Please provide the time_prefix and time_format for below event type.

Explorer

Hi folks,

Could you please anyone provide the TIME_PREFIX and TIME_FORMAT for below events type.

10.30.3.247 - - [08/Oct/2017:23:01:00 -0500] "GET /replocator-ws/services/RepDealerLocator?wsdl HTTP/1.1" 200 29638

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

@p_gurav

[<spec>]
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z

there will : instead of space

0 Karma

Explorer

The above methods is not working and the below format is working

TIME_PREFIX=[
TIME_FORMAT= %d/%b/%Y :%H:%M:%S %-4N

0 Karma

SplunkTrust
SplunkTrust

the sample event that you have mention does not contain space
if it does then you can write

TIME_FORMAT = %d/%b/%Y :%H:%M:%S %z
0 Karma

Champion

Hi lksridhar,

TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y %H:%M:%S %z

Before this can you also try increasing value for MAX_TIMESTAMP_LOOKAHED property in props.conf file

0 Karma