Archive

Unwanted characters in time stamp

Explorer

I have a log with a timestamp that looks like this:

<135>May 24 03:20:33

I'm no regexp expert so I am asking, what is the best way ofe getting rid of the <135> characters?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Are you wanting to remove it for reporting purposes or to ensure Splunk accurately extracts the timestamp?

To ensure Splunk accurately extracts the timestamp, you may add this to your props.conf beneath the applicable sourcetype, host, or source stanza:

[relevant_stanza]
TIME_PREFIX = ^\<[^\>]+\>

You could also add the following settings in the same place. They would help with efficiency a bit but likely not be required:

MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %b %d %T

The <135> shouldn't bother you during search time, but if it does - you can easily work around it using one of many techniques. Please let us know if it is a search-time question (with an example) and we'll focus on that instead.

View solution in original post

Splunk Employee
Splunk Employee

Are you wanting to remove it for reporting purposes or to ensure Splunk accurately extracts the timestamp?

To ensure Splunk accurately extracts the timestamp, you may add this to your props.conf beneath the applicable sourcetype, host, or source stanza:

[relevant_stanza]
TIME_PREFIX = ^\<[^\>]+\>

You could also add the following settings in the same place. They would help with efficiency a bit but likely not be required:

MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %b %d %T

The <135> shouldn't bother you during search time, but if it does - you can easily work around it using one of many techniques. Please let us know if it is a search-time question (with an example) and we'll focus on that instead.

View solution in original post

Explorer

Thanks! Just what I was looking for. 🙂

0 Karma