Hi there..
I have a big problem with props.conf. I have logs from a server with time format like this..
0402 220121.414712...this means MMDD HHMMSS.QQQQQQ
Need help with Regex for props.conf, respectively I need to convert this string into time.
thanks for any help
Nikola
Hi Nikola,
Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).
In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.
Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712
and sourcetype=nix-all-logs
😞
[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")
Hi Nikola,
Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).
In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.
Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712
and sourcetype=nix-all-logs
😞
[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")
It works now, I used old configuration from your first post...
Nikola
Hi bwooden,
Unfortunately after reconfiguration my props.conf file, the problem persists, time format is still unrecognizable.
Have you any idea why?
Thanks
Nikola
bwooden thank you for your answer and effort..
This was a problem for me..I can do it in search but with props there was a problem..
I will try this on next week..have a nice day
nikola