Getting Data In

Help with date Regex

Path Finder

The find folks at Fortigate have chosen an "unusual" log format for their URL logs. Pretty simple except for the fact that the Event date is not the first date that Splunk sees. For example here is a sample (sanitized) record in the log:

fort_url|BBOG|MTFCCDF08G|2016-09-25|09:00:00.|1|genkdca-fgat93|url.passthrough|6|TCP|::FFFF:192.168.1.1|53649|53649|::FFFF:135.11.107.20|443|443|52:Information Technology|9-25-2016@08:59:35|msg=URL belongs to an allowed category in policy:|mtfccdf08g-s:mtfccdf08g-n|either|https://fakehost.com

Splunk grabs the recorded date "2016-09-25|09:00:00" fields as the date, but the date I really want recorded as the event time is "9-25-2016@08:59:35" I went into Advance timeStamp extraction settings and entered "%Y-%m-%d@%H%M" as the timestamp format. The place I am stuck is the regex I need to put in for Timestamp prefix. These pipe symbol as the field delimiter is really screwing me up. I really don't know what regex will work as the prefix. Can someone take pity on my and tell me what regex will work?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

View solution in original post

Path Finder

Thanks! Just what is was looking for. The TIME_FORMAT worked great with one minor tweak. The '@' did not need to be escaped.

0 Karma

SplunkTrust
SplunkTrust

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

View solution in original post

Legend

Try this

TIME_FORMAT = %-m-%-d-%Y@%H:%M:%S
0 Karma