Getting Data In

Help with date Regex

ehoward
Path Finder

The find folks at Fortigate have chosen an "unusual" log format for their URL logs. Pretty simple except for the fact that the Event date is not the first date that Splunk sees. For example here is a sample (sanitized) record in the log:

fort_url|BBOG|MTFCCDF08G|2016-09-25|09:00:00.|1|genkdca-fgat93|url.passthrough|6|TCP|::FFFF:192.168.1.1|53649|53649|::FFFF:135.11.107.20|443|443|52:Information Technology|9-25-2016@08:59:35|msg=URL belongs to an allowed category in policy:|mtfccdf08g-s:mtfccdf08g-n|either|https://fakehost.com

Splunk grabs the recorded date "2016-09-25|09:00:00" fields as the date, but the date I really want recorded as the event time is "9-25-2016@08:59:35" I went into Advance timeStamp extraction settings and entered "%Y-%m-%d@%H%M" as the timestamp format. The place I am stuck is the regex I need to put in for Timestamp prefix. These pipe symbol as the field delimiter is really screwing me up. I really don't know what regex will work as the prefix. Can someone take pity on my and tell me what regex will work?

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

View solution in original post

ehoward
Path Finder

Thanks! Just what is was looking for. The TIME_FORMAT worked great with one minor tweak. The '@' did not need to be escaped.

0 Karma

somesoni2
Revered Legend

Add following attribute to your sourcetype definition

[yoursourcetype]
TIME_PREFIX = ^([^\|]+\|){17}
TIME_FORMAT = %m-%d-%Y\@%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD =19

sundareshr
Legend

Try this

TIME_FORMAT = %-m-%-d-%Y@%H:%M:%S
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...