Newbie question - can't get Splunk to locate the timestamp in redis log file

[socalvin]

The following settings don't seem to be able to tell Splunk to locate the timestamp, although I have tried using the same regex in vi editor to verify that the expression is correct. Any idea?

TIME_FORMAT=%d%t%b%t%H:%M:%S
TIME_PREFIX=\d{2}\s\w{3}\s\d{2}:\d{2}:\d{2}

Sample of the log:

[27779] 27 Mar 22:01:27 * 1 changes in 900 seconds. Saving...
[27779] 27 Mar 22:01:27 * Background saving started by pid 3915
[3915] 27 Mar 22:01:27 * DB saved on disk
[27779] 27 Mar 22:01:27 * Background saving terminated with success
[27779] 27 Mar 22:05:35 # Received SIGTERM, scheduling shutdown...
[27779] 27 Mar 22:05:36 # User requested shutdown...
[27779] 27 Mar 22:05:36 * Saving the final RDB snapshot before exiting.

[lguinn2]

I think your TIME_PREFIX is wrong. And my real question is this: what happens if you leave all that out and just let Splunk figure it out? This is a pretty common format, and I think Splunk might not need all of this. I might go as far as this in props.conf (on the indexer):

MAX_TIMESTAMP_LOOKAHEAD=25
SHOULD_LINEMERGE=false

Because that makes Splunk a bit more efficient, not because it is really necessary.

But if Splunk can't figure out the timestamp on its own, you could add:

TIME_FORMAT=%d%t%b%t%H:%M:%S
TIME_PREFIX=\[\d+]\s

[socalvin]

It still removed the strokes. Hopefully, someone in this forum or from Splunk could help me out. Thanks!

[socalvin]

It looks like the editor in this forum removed all the stroke in the regex. It should be:

"\d{2}\s\w{3}\s\d{2}:\d{2}:\d{2}"