Setting the time the event occured

[sklass]

Hi all,

I am streaming TCP data into splunk which comes in the format of this.

timestamp="09/15/2008 21:16:46" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2056" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2261" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 
timestamp="09/15/2008 21:16:47" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2058" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2284" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 

But when I'm looking at the data in Splunk it's not parsing the Time correctly. It's using the Time (column) it was uploaded as opposed to the timestamp which is what I want. This is some historical data that we want to parse out.

Now I thought I would need to create a props.conf in my (otherwise empty) project which I did and I did notice a slight change but I can't get the timestamp field to set the time..

Here is the contents of my current prop.conf.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
LINE_BREAKER = [\r\n]
SHOULD_LINEMERGE= false
MAX_EVENTS=1

Can someone show me the errors I'm creating? Thanks!!

[linu1988]

Hello,
Please try this.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
BREAK_ONLY_BEFORE = timestamp
MAX_DAYS_AGO = 5000
SHOULD_LINEMERGE= false

Thanks

[linu1988]

updated the answer try this..

[sklass]

Hi there - Hey thanks - It's still not working. Can you explain two things:
- If you see some other year it takes the year.
- need to check in datetime.xml file in etc folder