How to update props.conf to extract timestamp from my sample data?

[sravankaripe]

Please help me with props.conf file i have sample data below i want to extract time stamp from the below sample data.

BREAK_ONLY_BEFORE=
TIME_PREFIX=
TIME_FORMAT=

10.123.123.12 - - [02/Nov/2016:00:36:31 -0500] "POST /comp/apps/services/api/comp/iphone/init HTTP/1.1" 123 12345 1234 WAS=abc-abcdef12-xzy12.maps.ib:1234 TMS=12345 T=0 "-" "comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00),comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00)/somexzyAPI/7.0.0.0" "-" JSessionID=1234aLpYQEcNOxbnZeE7eCMv5zO:mfp-wlprod12-abc01-MfpProdSrv12 "-"

[dmaislin_splunk]

SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
MAX_TIMESTAMP_LOOKAHEAD=26
CHARSET=UTF-8

[sravankaripe]

thanks sir this is also working.

[somesoni2 · Accepted solution]

Try this for your sourcetype definition/props.conf

[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d+\.\d+\.\d+\.\d+\s+)
TIME_PREFIX = ^(\S+\s+){3}\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
MAX_TIMESTAMP_LOOKAHEAD = 26

[dbcase]

I had the same question just last week. Somesoni2's answer worked for me 🙂

[sravankaripe]

thanks its working

[skoelpin]

Try this

[YOUR_SOURCETYPE]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,$3N