Getting Data In

Can you help me out with the time settings in this props.conf?

Builder

All,

So here is my log -

date="[22/Jun/2016:17:25:05 +0000]" xff="166.170.220.3" 

It's well formated. I am just not sure how to handle the ="[ component?

0 Karma
1 Solution

Esteemed Legend

Like this:

props.conf:

TIME_PREFIX = date="\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%s %z
MAX_TIMESTAMP_LOOKAHEAD = 26

View solution in original post

0 Karma

Esteemed Legend

Like this:

props.conf:

TIME_PREFIX = date="\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%s %z
MAX_TIMESTAMP_LOOKAHEAD = 26

View solution in original post

0 Karma

Builder

Thanks! Worked like a charm.

0 Karma

SplunkTrust
SplunkTrust

Hi daniel333, You can use TIME_PREFIX props setting to tell splunk the pattern that precedes the timestamp, i.e.

TIME_PREFIX = date="\[

You can then set the MAX_TIMESTAMP_LOOKAHEAD to match the expected number of characters, i.e.

MAX_TIMESTAMP_LOOKAHEAD = 27

This should be effective to cause splunk to correctly assign a time to the event, but if not you can use TIME_FORMAT and work out the strftime setting that matches the timestamp.

Please let me know if this answers your question!

0 Karma

Path Finder

You could edit the props.conf's following configs to handle that:

TIME_PREFIX =

MAX_TIMESTAMP_LOOKAHEAD =
TIME_FORMAT =

These can be edited under $SPLUNK_HOME/etc/system/local OR in an app under $SPLUNK_HOME/etc/apps depending on your setup.

0 Karma