How to ask splunk to extract time_stamp only if time string is at the start of a line?

[houxiaoxiao]

I tried to put the "TIME_PREFIX = ^" at props.conf at system/default, system/local, myapp/default, myapp/local but none of them is working. What should I do?

[bbingham]

I think you may need to add more to your solution. By default, splunk will already will start looking at the start of a line for the timestamp. I think what you may be looking for will be achieved by using MAX_TIMESTAMP_LOOKAHEAD in conjunction with what you have. By default splunk looks from the start of a line, then looks up to 150 char in the event for a timestamp. By adjusting MAX_TIMESTAMP_LOOKAHEAD, you can control how far into an event splunk looks for the timestamp. If you use something like the following:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 10

Splunk will start on the first character, and count up to 10 more characters for a timestamp. Adjust your MAX_TIMESTAMP_LOOKAHEAD to fit your timestamp syntax and splunk will be forced to match your timestamp at the start of the line.

Hope that helps