Hello
i have this event for example:
$changeSystemTimeCmd 1533808153 -newTime 1533808153 -oldTime 1533808147
i need to set the timestamp to take the first number after the first string. in this can it is
$changeSystemTimeCmd
but it can be any string.
i tried with timestamp lookahead 30 but the problem is that i can't know what will be the length of this first string
how can i set timestamp lookahead regex to take the first number after first string ?
Hi,
You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.
props.conf
[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10
Hi,
You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.
props.conf
[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10
i don't have indexer or HF
im running on all in one configuration so the sourcetype configuration located on props.conf in the app
it is working ! can you please explain why MAX_TIMESTAMP_LOOKAHEAD=10 ?
If you are running standalone splunk instance then also it will work. I have tested same config in Add Data in my lab splunk instance and it is working for me.
MAX_TIMESTAMP_LOOKAHEAD
will count after TIME_PREFIX
, in above config TIME_PREFIX
regex cover till first whitespace so this $changeSystemTimeCmd
is captured with TIME_PREFIX regex and after that you have 10 digit epoch time format so I have given 10 in MAX_TIMESTAMP_LOOKAHEAD
thanks for your answer
it is working
i see it is also work without MAX_TIMESTAMP_LOOKAHEAD
the thing is that im afraid that the epoch time will be with more than 10 digits so if it is not necessary to limit i think it will be better
what do you think ?
If you do not set MAX_TIMESTAMP_LOOKAHEAD
then it will take default value which is 128 character, I'll suggest to define MAX_TIMESTAMP_LOOKAHEAD
with max length of your epoch time.