Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Can't extract simple YYYYMMDD data to be event...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have PSV files in such format. Date is in 2nd column.
Haven't spent much time to try different setting, but Splunk still took file modified time as event time stamp. I'm stilling asking myself what's wrong with "TIME_FORMAT= %Y%m%d"??
Anyone can help to see what's wrong of my props.conf?
foo|20131201|bar|...
[unixops:sitelog]
SHOULD_LINEMERGE = false
TIME_FORMAT= %Y%m%d
LEARN_MODEL = false
INDEXED_EXTRACTIONS = PSV
FIELD_NAMES = host,date,log,message_type,region,city,campus,building,status,personality
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It works now. A silly mistake...
I didn't pay attention TIME_PREFIX is regex based.
So the answer is
TIME_PREFIX = \|
Thanks helping me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It works now. A silly mistake...
I didn't pay attention TIME_PREFIX is regex based.
So the answer is
TIME_PREFIX = \|
Thanks helping me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good to know that it worked. Dont forget to accept the answer 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In your case, you need to set TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD. Check the props.conf documenattion
http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Propsconf
TIME_PREFIX = foo|
MAX_TIMESTAMP_LOOKAHEAD = 12
Try these. Change the values as required.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you tell what will be there before |20131201. Is it one word or multiple words separated by |.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"foo" is not fixed value.
I did try TIME_PREFIX = | and MAX_TIMESTAMP_LOOKAHEAD = 50 , still didn't work
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
