Getting Data In

TIME_PREFIX regex help

wouterr
Explorer

Hi,

I seem to be incapable of figuring out what regex to provide in the TIME_PREFIX for my source type in order to recognize the second time stamp instead of the first.

Please see a sample event below

"Jun 04 2013 12:00:00:001AM","5333079266","310410257633304","8","Jun 03 2013 03:55:43:000PM"

Thanks

Tags (2)
0 Karma
1 Solution

Hajime
Path Finder

Hello wouterr,

I think as you said bmacias84, and may be set as follows.

TIME_PREFIX=","

OR

TIME_PREFIX=,"

View solution in original post

0 Karma

Hajime
Path Finder

Hello wouterr,

I think as you said bmacias84, and may be set as follows.

TIME_PREFIX=","

OR

TIME_PREFIX=,"

0 Karma

bmacias84
Champion

I see you have two timestamps so you want the second timestamp used for _time? if so try


TIME_PREFIX=","
TIME_FORMAT=%b %d %Y %I:%M:%S:%3N:%r

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...