Hi folks,
Could you please anyone provide the TIME_PREFIX and TIME_FORMAT for below events type.
10.30.3.247 - - [08/Oct/2017:23:01:00 -0500] "GET /replocator-ws/services/RepDealerLocator?wsdl HTTP/1.1" 200 29638
@p_gurav
[<spec>]
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
there will :
instead of space
The above methods is not working and the below format is working
TIME_PREFIX=[
TIME_FORMAT= %d/%b/%Y :%H:%M:%S %-4N
the sample event that you have mention does not contain space
if it does then you can write
TIME_FORMAT = %d/%b/%Y :%H:%M:%S %z
Hi lksridhar,
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y %H:%M:%S %z
Before this can you also try increasing value for MAX_TIMESTAMP_LOOKAHED property in props.conf file