Splunk Time_format and Timestamp prefix option?

[poojithavasanth]

I have the data has "1111|xxx, xxx y|000000|111111|firstname, lastname|10/13/22 02:12:09|"

I used TIME_FORMAT = %m/%d/%Y %H:%M:%S

and Timestamp prefix = ^(?:[^\|\n]*\|){5}

However, I still get an error stating could not use strptime to parse the timestamp.

Would need help in providing timestamp prefix here.

[PickleRick]

Firstly, unless you have some strange linebreakers, you don't have to account for \n within the event.

Secondly, if memory serves me right, within a character set you don't escape characters.

So you can try with

TIME_PREFIX = ^([^|]*|){5}

And you need %y instead of %Y (you don't have full year number, just two last digits)

[poojithavasanth]

I see it recognizes the timestamp without adding TIME_PREFIX but with an error "could not use strptime to parse timetsamp".

My goal is to clear the error, which is only possible by adding TIME_PREFIX which suits the situation.

[gcusello]

Hi @poojithavasanth,

if you have the above error, Splunk assignes the current timestamp to the event.

Did you tried to use the Add-data function to find the correct timestamp?

I tried using your data and the automatic recognition recognizes your timestamp

Ciao.

Giuseppe

[poojithavasanth]

Thanks for the providing this information. I still do not see it working.

[gcusello]

Hi @poojithavasanth,

trying with Add data, try to leave the auto detection.

In other words, set the TIME_FORMAT but not the TIME_PREFIX, if you haven't any other date in the log it should recognize the timestamp.

Ciao.

Giuseppe

[poojithavasanth]

File is in .txt format and file content are in psv (pipe-delimited)

Also, Lookahead with 63 did not work too. I believe there should be some updates in TIME_PREFIX.

[gcusello]

Hi @poojithavasanth,

please try this:

TIME_PREFIX = ^([^\|]+\|){5}

Ciao.

Giuseppe

[poojithavasanth]

Yes, it is TIME_PREFIX

[gcusello]

Hi @poojithavasanth,

is your extraction a csv?

did you tried with INDEXED_EXTRACTION = csv?

Anyway, to debug your problem try to manually add a sample of your data using the GUI (Add data) in this way, you can immediately try different options.

Maybe the problem is Lookahead , try with a minor value e,g, 63.

ciao.

Giuseppe

[gcusello]

Hi @poojithavasanth,

I suppose that when you say "Timestamp prefix" you mean TIME_PREFIX, is it correct?

Ciao.

Giuseppe