Getting Data In

Parser finding time but not date.

inglisn
Path Finder

I have an event that starts something like this:

2012-03-20 06:07:00.000,BLANK,11.12.13.14,,,IP,Linux hostname 2.6.18-194.el5 1 SMP Tue Mar 16 21:52:39 EDT 2010 x86 64,

The first field is the timestamp of the event, I've inserted a blank value to separate it from the IP it seemed to not be identifying that as a proper timestamp. The problem I've got is the parser is using the time portion of the timestamp (06:07:00) but the date from the kernel string ( "Mar 16 .... 2010" ).

Within inputs.conf I've tried adding a prefix to lock the lookahead to the start of the event and not look beyond the end of the timestamp, but it still picks out the wrong thing.

TIME_FORMAT = %Y-%m-%d %H:%M:$S.000
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 25
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

These are good settings, but they belong in props.conf, not inputs.conf. And the stanza header for props.conf is a little different.

[yourSourcetype]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.000
MAX_TIMESTAMP_LOOKAHEAD = 25

should do it. You might not even need the time format.

View solution in original post

0 Karma

lguinn2
Legend

These are good settings, but they belong in props.conf, not inputs.conf. And the stanza header for props.conf is a little different.

[yourSourcetype]
TIME_FORMAT = %Y-%m-%d %H:%M:%S.000
MAX_TIMESTAMP_LOOKAHEAD = 25

should do it. You might not even need the time format.

0 Karma

inglisn
Path Finder

Doh!

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...