Getting Data In

How to configure props.conf to identify and convert my sample time format string for sourcetype=nix-all-logs?

nikolab
Explorer

Hi there..

I have a big problem with props.conf. I have logs from a server with time format like this..
0402 220121.414712...this means MMDD HHMMSS.QQQQQQ
Need help with Regex for props.conf, respectively I need to convert this string into time.

thanks for any help

Nikola

1 Solution

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

nikolab
Explorer

It works now, I used old configuration from your first post...

Nikola

0 Karma

nikolab
Explorer

Hi bwooden,
Unfortunately after reconfiguration my props.conf file, the problem persists, time format is still unrecognizable.
Have you any idea why?

Thanks
Nikola

0 Karma

nikolab
Explorer

bwooden thank you for your answer and effort..
This was a problem for me..I can do it in search but with props there was a problem..
I will try this on next week..have a nice day

nikola

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...