Help with date Regex

[ehoward]

The find folks at Fortigate have chosen an "unusual" log format for their URL logs. Pretty simple except for the fact that the Event date is not the first date that Splunk sees. For example here is a sample (sanitized) record in the log:

fort_url|BBOG|MTFCCDF08G|2016-09-25|09:00:00.|1|genkdca-fgat93|url.passthrough|6|TCP|::FFFF:192.168.1.1|53649|53649|::FFFF:135.11.107.20|443|443|52:Information Technology|9-25-2016@08:59:35|msg=URL belongs to an allowed category in policy:|mtfccdf08g-s:mtfccdf08g-n|either|https://fakehost.com

Splunk grabs the recorded date "2016-09-25|09:00:00" fields as the date, but the date I really want recorded as the event time is "9-25-2016@08:59:35" I went into Advance timeStamp extraction settings and entered "%Y-%m-%d@%H%M" as the timestamp format. The place I am stuck is the regex I need to put in for Timestamp prefix. These pipe symbol as the field delimiter is really screwing me up. I really don't know what regex will work as the prefix. Can someone take pity on my and tell me what regex will work?

Thanks!

[ehoward]

Thanks! Just what is was looking for. The TIME_FORMAT worked great with one minor tweak. The '@' did not need to be escaped.

[somesoni2 · Accepted solution]

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

[sundareshr]

Try this

TIME_FORMAT = %-m-%-d-%Y@%H:%M:%S