Getting Data In

How to configure props.conf to identify and convert my sample time format string for sourcetype=nix-all-logs?

nikolab
Explorer

Hi there..

I have a big problem with props.conf. I have logs from a server with time format like this..
0402 220121.414712...this means MMDD HHMMSS.QQQQQQ
Need help with Regex for props.conf, respectively I need to convert this string into time.

thanks for any help

Nikola

1 Solution

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Hi Nikola,

Splunk can often identify timestamps on its own. Yet we can improve its performance by telling Splunk exactly where to find the timestamp (and its format).

In some cases, like the one in your question, Splunk does not recognize the timestamp. Still, we can easily instruct Splunk what timestamp to expect using strptime notation. Bonus: We can also use that notation to format the timestamp as we'd like to see it at search time.

Here is a sample props.conf entry you could use to do all of those things (I'm making the assumption the events start with 0402 220121.414712 and sourcetype=nix-all-logs😞

[nix-all-logs]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}\s\d{6}\.\d{6}
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT=%m%d %H%M%S.%6N
EVAL-timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S.%6N")

View solution in original post

nikolab
Explorer

It works now, I used old configuration from your first post...

Nikola

0 Karma

nikolab
Explorer

Hi bwooden,
Unfortunately after reconfiguration my props.conf file, the problem persists, time format is still unrecognizable.
Have you any idea why?

Thanks
Nikola

0 Karma

nikolab
Explorer

bwooden thank you for your answer and effort..
This was a problem for me..I can do it in search but with props there was a problem..
I will try this on next week..have a nice day

nikola

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!