Please provide the time_prefix and time_format for below event type.

[lksridhar]

Hi folks,

Could you please anyone provide the TIME_PREFIX and TIME_FORMAT for below events type.

10.30.3.247 - - [08/Oct/2017:23:01:00 -0500] "GET /replocator-ws/services/RepDealerLocator?wsdl HTTP/1.1" 200 29638

[mayurr98]

@p_gurav

[<spec>]
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z

there will : instead of space

[lksridhar]

The above methods is not working and the below format is working

TIME_PREFIX=[
TIME_FORMAT= %d/%b/%Y :%H:%M:%S %-4N

[mayurr98]

the sample event that you have mention does not contain space
if it does then you can write

TIME_FORMAT = %d/%b/%Y :%H:%M:%S %z

[p_gurav]

Hi lksridhar,

TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y %H:%M:%S %z

Before this can you also try increasing value for MAX_TIMESTAMP_LOOKAHED property in props.conf file