How to configure props.conf to identify and convert my sample time format string for sourcetype=nix-all-logs?

[nikolab]

Hi there..

I have a big problem with props.conf. I have logs from a server with time format like this..
0402 220121.414712...this means MMDD HHMMSS.QQQQQQ
Need help with Regex for props.conf, respectively I need to convert this string into time.

thanks for any help

Nikola

[bwooden · Accepted solution]

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

[nikolab]

It works now, I used old configuration from your first post...

Nikola

[nikolab]

Hi bwooden,
Unfortunately after reconfiguration my props.conf file, the problem persists, time format is still unrecognizable.
Have you any idea why?

Thanks
Nikola

[nikolab]

bwooden thank you for your answer and effort..
This was a problem for me..I can do it in search but with props there was a problem..
I will try this on next week..have a nice day

nikola