Getting Data In
Highlighted

Need help on TIME_FORMAT and TIME_PREFIX

Explorer

I have a props.comf that is not working for TIMEFORMAT and TIMEPREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help.

Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime)

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINEBREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)
MAX
TIMESTAMPLOOKAHEAD=30
NO
BINARYCHECK=1
SHOULD
LINEMERGE=false
TIMEFORMAT= %H-%m-%d %H:%M:%S,3N
TIME
PREFIX=\s
disabled=false
pulldown_type=true

0 Karma
Highlighted

Re: Need help on TIME_FORMAT and TIME_PREFIX

SplunkTrust
SplunkTrust

Hi @sathiyasun,

What is the timestamp in your sample data :2018-08-27 14:28:06,382 OR 2018-08-27 14:28:15,000?

0 Karma
Highlighted

Re: Need help on TIME_FORMAT and TIME_PREFIX

Explorer

This is the date &timestamp
DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382

0 Karma
Highlighted

Re: Need help on TIME_FORMAT and TIME_PREFIX

SplunkTrust
SplunkTrust

I am assuming that you have multi line events in that case please try with TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N , TIME_PREFIX = ^(?s)(?:[^\:]*\:){2} and SHOULD_LINEMERGE = true in props.conf on Indexer or Heavy forwarder whichever comes first from UF.

0 Karma
Highlighted

Re: Need help on TIME_FORMAT and TIME_PREFIX

SplunkTrust
SplunkTrust

I think you need TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N.
The TIME_PREFIX setting should not be "\s" as none of the timestamps in your sample event are preceded by a space. Perhaps TIME_PREFIX = : will work.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Need help on TIME_FORMAT and TIME_PREFIX

Splunk Employee
Splunk Employee

hi @sathiyasun,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!!

0 Karma