Need help on TIME_FORMAT and TIME_PREFIX

[sathiyasun]

I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help.

Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime)

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true

[mstjohn_splunk]

hi @sathiyasun,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!!

[richgalloway]

I think you need TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N.
The TIME_PREFIX setting should not be "\s" as none of the timestamps in your sample event are preceded by a space. Perhaps TIME_PREFIX = : will work.

[harsmarvania57]

Hi @sathiyasun,

What is the timestamp in your sample data :2018-08-27 14:28:06,382 OR 2018-08-27 14:28:15,000?

[sathiyasun]

This is the date &timestamp
DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382

[harsmarvania57]

I am assuming that you have multi line events in that case please try with TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N , TIME_PREFIX = ^(?s)(?:[^\:]*\:){2} and SHOULD_LINEMERGE = true in props.conf on Indexer or Heavy forwarder whichever comes first from UF.