How to define a time format using regex?

[clyde772]

How can I define manually force define the date and time. Splunk didn't properly processes the correct time in the event vs time it indexed.

---

processingFailureEvent - HADAP_CPU_ALM - M-DAP5_B, Cab 1, Cage 1, Slot 1, HADAP_CPU_ALM 1 - Jan 12, 2011 10:33:30.

I have tried to give it a shot like below, but didn't work.

TIME_FORMAT="%b %d, %Y %H:%M:%S."

I appreciate guru's suggestions! Thanks.

[Lowell]

Have you tried simply removing those double-quotes? That could be your problem. You also don't need a . (period) after %S (Oh, and this is not "regex" syntax, it a strptime format string.)

[Rob]

You might want to take a look at the following documentation links:

http://www.splunk.com/base/Documentation/4.1.6/Admin/ConfigureTimestampRecognition

http://www.splunk.com/base/Documentation/4.1.6/admin/ConfigurePositionalTimestampExtraction

For the event you are showing above, you might want to add something similar such as the following stanza:

[<source|sourcetype|host>]
MAX_TIMESTAMP_LOOKAHEAD = 90
TIME_PREFIX = .+(?=\w{3} \d{2}, \d{4} \d{2}:\d{2}:\d{2})
TIME_FORMAT = %b %d, %Y %H:%M:%S

The MAX_TIMESTAMP_LOOKAHEAD is the number of characters that Splunk should "skip" before it starts looking for a timestamp. 90 is the number I used above as your time stamp starts after 92 characters. This is something that could be different for different events so you may want to change that value accordingly. The regex for the TIME_PREFIX will essentially match anything before that time stamp format that is at the end of the string which should pretty much guarantee that the correct timestamp is found according to the event you provided.

[MarioM]

did you try with TIME_PREFIX to point to the space exactly before your event's timestamp?

something like this in your props.conf:

[<source or sourcetype or host>]
TIME_PREFIX = .*\s-\s
TIME_FORMAT = %b %d, %Y %H:%M:%S