Getting Data In

Splunk pulling the date from log data - not timestamp

hharvey
Explorer

I have two types of logs that are formatted thusly:

hostname app->name: date time log data

and

hostname:date time log data

Very sporadically the log data portion of these logs may have a date in it (this is user inputted text) and Splunk pulls the date from the log data in these cases. It causes future dated events that seem like they would be easy to fix, but can't come up with the right props.conf stanza to fix.

Examples:

a2-sb123 App->internal: 2011-12-13 15:23:24,556 INFO  internal  - Incoming Header: subject=FW:A Cool Night Out - Dec. 14, 2011
a2-sb123 App->internal: 2011-12-12 21:28:33,338 INFO  internal  - Incoming Header: subject=FW:December 14, 2011: This is the subject

a2-sb124:2011-12-12 20:50:12,950 INFO  [UI] !!!!! username clicked on saveandnext for agent Dec 14 2011 in SLE
a2-sb124:2011-12-13 03:53:31,689 INFO  UI [ID:wyetdTDrewWE1] - !!!!! username clicked on save for agent 14 Dec 2011 in SLE

Though the logs are dated correctly, Splunk dates the events for December 14th.

I've tried using this in props.conf, but it's not working, maybe it's the use of wildcard? Unfortunately host is the easiest spec to use to get to this data, as the sources and sourcetypes are varied for these servers.

[host::a2-sb*]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 50

Any suggestions?

0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

The "*" is legal in the host setting in the props.conf. You might try the following in your props.conf

[host::a2-sb*]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = \w+:

View solution in original post

tgow
Splunk Employee
Splunk Employee

The "*" is legal in the host setting in the props.conf. You might try the following in your props.conf

[host::a2-sb*]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = \w+:
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...