Getting Data In

Time stamp separated by a tab

silvermail
Path Finder

Hello guys,

Been trying to get this to work but to no avail...

I have a CSV file that goes like this:

pid hostname c1 c2 c3 status date time message
123456 serverA 0 0 0 54058938 20100301 033412 Error with Transfer

I am trying to parse the fields date and time and I have specified something like this in my props.conf

TIME_PREFIX = \w+\s\w+\s\w+\s\w+\s\w+\s\w+\s
TIME_FORMAT = %Y%m%d %H%M%S

But I couldn't get the date/time indexed correctly.

But if I change my original log source to be 20100301033412 (without the space in-between), it works fine.

Has anyone solved this before? Any response is much appreciated. Thanks.

Tags (1)
0 Karma
1 Solution

silvermail
Path Finder

Ah, got it.

It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S (with a tab and not a space as the CSV is using tab delimeter).

View solution in original post

silvermail
Path Finder

Ah, got it.

It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S (with a tab and not a space as the CSV is using tab delimeter).

silvermail
Path Finder

I did use \t and I believe it will work as well. Will try %t next time if I run into any issues. Thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I believe you can use %t in the time formats to represent any white space, including a tab character. I am not sure if \t would work specifically for a tab character, but there is a good chance it will.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...