Getting Data In

How to configure props.conf to identify and convert my sample time format string for sourcetype=nix-all-logs?

nikolab
Explorer

Hi there..

I have a big problem with props.conf. I have logs from a server with time format like this..
0402 220121.414712...this means MMDD HHMMSS.QQQQQQ
Need help with Regex for props.conf, respectively I need to convert this string into time.

thanks for any help

Nikola

1 Solution

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

nikolab
Explorer

It works now, I used old configuration from your first post...

Nikola

0 Karma

nikolab
Explorer

Hi bwooden,
Unfortunately after reconfiguration my props.conf file, the problem persists, time format is still unrecognizable.
Have you any idea why?

Thanks
Nikola

0 Karma

nikolab
Explorer

bwooden thank you for your answer and effort..
This was a problem for me..I can do it in search but with props there was a problem..
I will try this on next week..have a nice day

nikola

0 Karma
Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...