How to parse NSi autostore logs? Timestamps without leading zeros or spaces.

[af93yjym]

We want to collect NSi autostore logs in Splunk. Unfortunately Splunk is not able to parse the logs by default.

Log example:

5/28/2015^13:3:5:6^r_source_700 1^STATUS MESSAGE^Object ID: 125478
5/28/2015^13:3:5:6^r_source_700 1^STATUS MESSAGE^E-Mail: 
5/28/2015^13:3:5:23^r_source_700 1^STATUS MESSAGE^SAP XYZ: Entering Component.
5/28/2015^13:3:5:25^r_source_700 1^STATUS MESSAGE^SAP XYZ: 1 documents to Route.

The Datetime contains no leading zeros or spaces. The format is:
day/month/year^hour:minute:second:millisecond

We tried to parse the Time with: TIME_FORMAT=%-m/%-d/%Y^%-H:%-M:%-S:%-N but it did not worked.

Does someone knows a possibility to parse that kind of Timestamp?

Thank you in advance
Lars

[richgalloway]

Assuming the timestamp format is correct, the TIME_FORMAT string %m/%d/%Y^%H:%M:%S:%N works for me.

[af93yjym]

Unfortunatly not for us. Is there any tool which parses the logs and gives some information about the parsing results?

[richgalloway]

I used Splunk. Put a copy of your log on the Splunk server. Go to Settings->Data Inputs and click "Add New" next to "Files". Browse to the location of your log file and click Open. The Data Preview window will show how Splunk parses the log. Select the Timestamps tab to tell Splunk how to parse your time format.

[richgalloway]

Are you sure about the timestamp format? There is no 28th month in our current calendar.

[af93yjym]

You are right. I meant month/day/year, of course.