Deployment Architecture

Help with Time prefix and date format

nipendo
Engager

What time prefix and time format should I use.
I will appreciate your help with this one.

=INFO REPORT==== 15-Jan-2018::09:51:48 ===
connection <0.9091.502> (192.168.1.56:61982 -> 192.168.1.81:5672): user aaaa' authenticated and granted access to vhost '/'

=INFO REPORT==== 15-Jan-2018::09:51:48 ===
closing AMQP connection <0.9091.502> (192.168.1.56:61982 -> 192.168.1.81:5672, vhost: '/', user: 'aan')

=WARNING REPORT==== 15-Jan-2018::09:51:48 ===
Could not find handle.exe, please install from sysinternals

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

hey try this

TIME_FORMAT = %d-%b-%Y::%H:%M:%S
TIME_PREFIX = REPORT====\s

let me know if this helps !

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

TIME_PREFIX = =
TIME_FORMAT = %d-%b-%Y::%H:%M:%S
---
If this reply helps you, Karma would be appreciated.
0 Karma

mayurr98
Super Champion

hey try this

TIME_FORMAT = %d-%b-%Y::%H:%M:%S
TIME_PREFIX = REPORT====\s

let me know if this helps !

cmerriman
Super Champion

are you trying to extract a timestamp from these logs during index or during search?

0 Karma

nipendo
Engager

i am trying to index these logs.
i want to know what should i write in props.conf
like:
MAX_TIMESTAMP_LOOKAHEAD = 50
NO_BINARY_CHECK = true
TIME_FORMAT = %d/%m/%Y %H:%M:%S.%3N
TIME_PREFIX = ^
category = Custom

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...