Getting Data In

Need help on TIME_FORMAT and TIME_PREFIX

sathiyasun
Explorer

I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help.

Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime)

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @sathiyasun,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N.
The TIME_PREFIX setting should not be "\s" as none of the timestamps in your sample event are preceded by a space. Perhaps TIME_PREFIX = : will work.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @sathiyasun,

What is the timestamp in your sample data :2018-08-27 14:28:06,382 OR 2018-08-27 14:28:15,000?

0 Karma

sathiyasun
Explorer

This is the date &timestamp
DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

I am assuming that you have multi line events in that case please try with TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N , TIME_PREFIX = ^(?s)(?:[^\:]*\:){2} and SHOULD_LINEMERGE = true in props.conf on Indexer or Heavy forwarder whichever comes first from UF.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!