Getting Data In

Time stamp extraction not working

Contributor

I have events which start like

16OCT13 AAAB 12:59:00 JAJAS DKDJD KDD

16OCT13 AABB 13:00:00 AJAJA AKAJK AKA

But i am not able to extract that particular timestamp for events

In my props.conf i used:

SHOULD_LINEMERGE=false

TIME_PREFIX=^

TIME_FORMAT=%d%b%y [A-Z]{4} %H:%M:%S

But doesn't seem to work. Please tell me what i am doing wrong?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

TIME_FORMAT does not accept regexes, only strptime style format

In your case you'd need put the literal AABB string in TIME_FORMAT=%d%b%y AABB %H:%M:%S.

Else, if the string is not known in advance, you'd probably need a custom datetime.xml

View solution in original post

Splunk Employee
Splunk Employee

TIME_FORMAT does not accept regexes, only strptime style format

In your case you'd need put the literal AABB string in TIME_FORMAT=%d%b%y AABB %H:%M:%S.

Else, if the string is not known in advance, you'd probably need a custom datetime.xml

View solution in original post

Contributor

I used configuration like

                            <text><![CDATA[(?<![\d\.])([012]\d|3[01])(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(20\d\d|19\d\d|[901]\d(?!\d))\s\w+\s([01]\d|2[0123])\:([0-6]\d)\:([0-6]\d)]]>\s*</text>

            </define>

In data preview it seems to work..but when i configure to read data from files, no data is getting indexed

0 Karma

Contributor

oh ok ...is there any documentation on making changes in datetime.xml

0 Karma