Pb with sourcetype and date format

[lefelle]

i have a file with field date like 03/08/2016 09:25 GMT+02:00

My sourcetype doesn't work with
%d/%m/%Y %H:%M %Z%z
\d{2}/\d{2}/\d{4} \d{2}:\d{2} \d{2}:\d{2}

I have Failed to parse timestamp. defaulting to file modtime

Thanks

[richgalloway]

Do you have any control over how the field is written? Splunk expects offsets in hhmm format rather than hh:mm.

Also, the regex string in your question doesn't match the sample date. Try \d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}

[lefelle]

it doens't work.
the message is :
could not use strptime to parse timestamp from ....
failed to parse timestamp

[richgalloway]

One does not use regular expressions with strptime. I'm not sure what you're doing with it. I just wanted to point out it doesn't match your data.

[lefelle]

In fact, i want to create a sourcetype to read my file. I selected Advance to define Format timestamp and Prefix timestamp. At this point, i have my parsing error.

[richgalloway]

That's probably because of the odd timestamp format. Do you have the ability to change it?
I've never seen %Z and %z used together in a format string. Have you tried %d/%m/%Y %H:%M %Z?

[lefelle]

Yes, i have.
It doesn't work too.

[richgalloway]

That brings us back to my first question, which hasn't been answered.

Can the date format be changed?

[lefelle]

I can't change the date format in the file. 😞
This file is create by nother system and i'm not ability to change it.

[richgalloway]

Then you may have to use SED within your props.conf file to change the field to a recognized format.

[lefelle]

how can do that ?

[richgalloway]

In the props.conf stanza for your sourcetype put:

SEDCMD-timestamp=s/\d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}/\1\2\3/g

This should convert the timestamp into %m/%d/%Y %H:%S%Z format.