Getting Data In

Setting the time the event occured

sklass
Path Finder

Hi all,

I am streaming TCP data into splunk which comes in the format of this.

timestamp="09/15/2008 21:16:46" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2056" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2261" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 
timestamp="09/15/2008 21:16:47" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2058" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2284" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 

But when I'm looking at the data in Splunk it's not parsing the Time correctly. It's using the Time (column) it was uploaded as opposed to the timestamp which is what I want. This is some historical data that we want to parse out.

Now I thought I would need to create a props.conf in my (otherwise empty) project which I did and I did notice a slight change but I can't get the timestamp field to set the time..

Here is the contents of my current prop.conf.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
LINE_BREAKER = [\r\n]
SHOULD_LINEMERGE= false
MAX_EVENTS=1

Can someone show me the errors I'm creating? Thanks!!

Tags (1)
0 Karma

linu1988
Champion

Hello,
Please try this.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
BREAK_ONLY_BEFORE = timestamp
MAX_DAYS_AGO = 5000
SHOULD_LINEMERGE= false

Thanks

0 Karma

linu1988
Champion

updated the answer try this..

0 Karma

sklass
Path Finder

Hi there - Hey thanks - It's still not working. Can you explain two things:
- If you see some other year it takes the year.
- need to check in datetime.xml file in etc folder

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...