Getting Data In

Need help on Timestamp extraction while parsing the log data at Indexer

maniu1609
Path Finder

I have a log file to be monitored and i need to extract timestamp.
Example events:
Fri Feb 02 2018 10:22:37 aaaaaaa bbbbbbb cccccc
Mon Feb 05 2018 11:00:50 gggggg aaaaaaa vvvvvv

Please help me how I can extract timestamp of the events. Thanks in advance!!

0 Karma
1 Solution

TISKAR
Builder

Hello you can use that in props.conf,

[ __auto__learned__ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d %Y %H:%M:%S
TIME_PREFIX=\w{3}\s

View solution in original post

TISKAR
Builder

Hello you can use that in props.conf,

[ __auto__learned__ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d %Y %H:%M:%S
TIME_PREFIX=\w{3}\s

maniu1609
Path Finder

Hi Tiskar,

Thanks for your time. May I know what's the use of SHOULD_LINEMERGE and NO_BINARY_CHECK.
I have gone through the splunk documents but unable to understand them. Can you please give me some examples to understand.

0 Karma

TISKAR
Builder

Hi,
Yes, A binary file is a file whose content must be interpreted by a program or a hardware processor that understands in advance exactly how it is formatted LIKE file.exe.
So When set NO_BINARY_CHECK to true, Splunk processes binary files.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...