Archive

Setting the time the event occured

Path Finder

Hi all,

I am streaming TCP data into splunk which comes in the format of this.

timestamp="09/15/2008 21:16:46" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2056" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2261" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 
timestamp="09/15/2008 21:16:47" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2058" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2284" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 

But when I'm looking at the data in Splunk it's not parsing the Time correctly. It's using the Time (column) it was uploaded as opposed to the timestamp which is what I want. This is some historical data that we want to parse out.

Now I thought I would need to create a props.conf in my (otherwise empty) project which I did and I did notice a slight change but I can't get the timestamp field to set the time..

Here is the contents of my current prop.conf.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
LINE_BREAKER = [\r\n]
SHOULD_LINEMERGE= false
MAX_EVENTS=1

Can someone show me the errors I'm creating? Thanks!!

Tags (1)
0 Karma

Champion

Hello,
Please try this.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
BREAK_ONLY_BEFORE = timestamp
MAX_DAYS_AGO = 5000
SHOULD_LINEMERGE= false

Thanks

0 Karma

Champion

updated the answer try this..

0 Karma

Path Finder

Hi there - Hey thanks - It's still not working. Can you explain two things:
- If you see some other year it takes the year.
- need to check in datetime.xml file in etc folder

0 Karma