Time stamp extraction not working

[adityapavan18]

I have events which start like

16OCT13 AAAB 12:59:00 JAJAS DKDJD KDD

16OCT13 AABB 13:00:00 AJAJA AKAJK AKA

But i am not able to extract that particular timestamp for events

In my props.conf i used:

SHOULD_LINEMERGE=false

TIME_PREFIX=^

TIME_FORMAT=%d%b%y [A-Z]{4} %H:%M:%S

But doesn't seem to work. Please tell me what i am doing wrong?

[_d_ · Accepted solution]

TIME_FORMAT does not accept regexes, only strptime style format

In your case you'd need put the literal AABB string in TIME_FORMAT=%d%b%y AABB %H:%M:%S.

Else, if the string is not known in advance, you'd probably need a custom datetime.xml

[adityapavan18]

I used configuration like

                            <text><![CDATA[(?<![\d\.])([012]\d|3[01])(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(20\d\d|19\d\d|[901]\d(?!\d))\s\w+\s([01]\d|2[0123])\:([0-6]\d)\:([0-6]\d)]]>\s*</text>

            </define>

In data preview it seems to work..but when i configure to read data from files, no data is getting indexed

[kristian_kolb]

http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

[adityapavan18]

oh ok ...is there any documentation on making changes in datetime.xml