Getting Data In

Parser finding time but not date.

inglisn
Path Finder

I have an event that starts something like this:

2012-03-20 06:07:00.000,BLANK,11.12.13.14,,,IP,Linux hostname 2.6.18-194.el5 1 SMP Tue Mar 16 21:52:39 EDT 2010 x86 64,

The first field is the timestamp of the event, I've inserted a blank value to separate it from the IP it seemed to not be identifying that as a proper timestamp. The problem I've got is the parser is using the time portion of the timestamp (06:07:00) but the date from the kernel string ( "Mar 16 .... 2010" ).

Within inputs.conf I've tried adding a prefix to lock the lookahead to the start of the event and not look beyond the end of the timestamp, but it still picks out the wrong thing.

TIME_FORMAT = %Y-%m-%d %H:%M:$S.000
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 25
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

These are good settings, but they belong in props.conf, not inputs.conf. And the stanza header for props.conf is a little different.

[yourSourcetype]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.000
MAX_TIMESTAMP_LOOKAHEAD = 25

should do it. You might not even need the time format.

View solution in original post

0 Karma

lguinn2
Legend

These are good settings, but they belong in props.conf, not inputs.conf. And the stanza header for props.conf is a little different.

[yourSourcetype]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.000
MAX_TIMESTAMP_LOOKAHEAD = 25

should do it. You might not even need the time format.

0 Karma

inglisn
Path Finder

Doh!

Thanks.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...