Getting Data In

Need help to get Timestamp correctly

lakromani
Builder

I have data in the following format (Serv-U ftp log)

[5] Sun 01Jun08 00:24:04 - (000555) Connected to 76.76.76.76 (Local address 10.11.12.13)

I need help to get Splunk to get time correctly out of this.

Time is in this format (I think)

%d%b%y %T

So how to do it?

Automatically locate timestamp (default)

or
Timestamp is always prefaced by a pattern

I tried Auto and entered the date format in format field. It then complain about prefix?

If I select "Timestamp is always prefaced..." what then to fill in the filed?

Thanks

Tags (1)
1 Solution

jeremiahc4
Builder

Is your timestamp always prefaced by the pattern above "[5] Sun "? (Assuming the number and the 3-char weekday changes).

If so, you could enter a prefaced regex such as "\[\d\]\s\w{3}\s" (not sure if escape needed on brackets or not)

View solution in original post

nitrogaute
New Member

I have a similar problem:

BREAK_ONLY_BEFORE=\d{7}
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%3N
TIME_PREFIX=\d{7}

Trying to parse out the millisecond timestamp from this log file, 9281736 :

  9281736 : COUNT IN 1003
Tx:   01 04 00 71 00 02 21 d0                              ...q..!.
Rx:   01 04 04 00 08 0a 28 7c f8    
  9282136 : COUNT IN 1003
Tx:   01 04 00 c9 00 02 a1 f5                              ........
Rx:   01 04 04 00 08 00 00 7a 46 

I suspect my TIME_FORMAT is wrong, because it breakes up events correctly.
Get the error of:

Could not use strptime to parse timestamp from ": COUNT 1003\n ......
Make sure a prefix pattern is
specified if the events don`t begin
with a timestamp.

Failed to parse timestamp. Defaulting to file modtime.

Any suggestion would be much appreciated!

0 Karma

ppablo
Retired

Hi @nitrogaute

Using the answer space on a post isn't really the best (or appropriate) way to find a solution to an issue you're having on this site. Can you please post this as a separate question?

0 Karma

hortonew
Builder

I'm a little late, but I just dealt with this yesterday. This is what was in my props.conf on my indexers for the servu_logs sourcetype:

[servu_logs]

SHOULD_LINEMERGE = false

LINE_BREAKER = ([\r\n]+)

TIME_PREFIX = [[\d]+]\s[\w]+\s

TIME_FORMAT = %d%b%y %H:%M:%S

0 Karma

jeremiahc4
Builder

Is your timestamp always prefaced by the pattern above "[5] Sun "? (Assuming the number and the 3-char weekday changes).

If so, you could enter a prefaced regex such as "\[\d\]\s\w{3}\s" (not sure if escape needed on brackets or not)

lakromani
Builder

Thanks, works perfect. I do added "regex" to the Timestamp field and "date format" in format field

Get Updates on the Splunk Community!

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...