Getting Data In

Extract timestamp from the logs

isha_rastogi
Path Finder

I've logs where events are not starting with time. Log format is
10.100.28.108 - - 2018-04-25--02-31-14 "PUT /mifs/c/i/abc/abc.html?c=1073768600 HTTP/1.1" 200 20 "-" "abc/1.0" 5252
I was trying below but getting error: couldnot use strptime to parse
[ test ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d--%H%-M-%S
TIME_PREFIX=\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\s-\s-
TZ=America/New_York

Tags (2)
0 Karma

TISKAR
Builder

Can you try this please:

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d--%H-%M-%S
TIME_PREFIX=(\d+\.){3}.\d+(\s-){2}\s
0 Karma

somesoni2
Revered Legend

Give this a try

[ test ]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\s+\S+){2}\s)
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d--%H%-M-%S
TIME_PREFIX=^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\s+\S+){2}\s
MAX_TIMESTAMP_LOOKAHEAD = 20
TZ=America/New_York
0 Karma

p_gurav
Champion

Can you try to edit your time_prefix:

TIME_PREFIX=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s-\s-
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...