Getting Data In

How to define a time format using regex?

clyde772
Communicator

How can I define manually force define the date and time. Splunk didn't properly processes the correct time in the event vs time it indexed.


processingFailureEvent - HADAP_CPU_ALM - M-DAP5_B, Cab 1, Cage 1, Slot 1, HADAP_CPU_ALM 1 - Jan 12, 2011 10:33:30.

I have tried to give it a shot like below, but didn't work.

TIME_FORMAT="%b %d, %Y %H:%M:%S."

I appreciate guru's suggestions! Thanks.

Tags (1)
0 Karma

Lowell
Super Champion

Have you tried simply removing those double-quotes? That could be your problem. You also don't need a . (period) after %S (Oh, and this is not "regex" syntax, it a strptime format string.)

0 Karma

Rob
Splunk Employee
Splunk Employee

You might want to take a look at the following documentation links:

http://www.splunk.com/base/Documentation/4.1.6/Admin/ConfigureTimestampRecognition

http://www.splunk.com/base/Documentation/4.1.6/admin/ConfigurePositionalTimestampExtraction

For the event you are showing above, you might want to add something similar such as the following stanza:

[<source|sourcetype|host>]
MAX_TIMESTAMP_LOOKAHEAD = 90
TIME_PREFIX = .+(?=\w{3} \d{2}, \d{4} \d{2}:\d{2}:\d{2})
TIME_FORMAT = %b %d, %Y %H:%M:%S

The MAX_TIMESTAMP_LOOKAHEAD is the number of characters that Splunk should "skip" before it starts looking for a timestamp. 90 is the number I used above as your time stamp starts after 92 characters. This is something that could be different for different events so you may want to change that value accordingly. The regex for the TIME_PREFIX will essentially match anything before that time stamp format that is at the end of the string which should pretty much guarantee that the correct timestamp is found according to the event you provided.

MarioM
Motivator

did you try with TIME_PREFIX to point to the space exactly before your event's timestamp?

something like this in your props.conf:

[<source or sourcetype or host>]
TIME_PREFIX = .*\s-\s
TIME_FORMAT = %b %d, %Y %H:%M:%S
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!