Time stamp separated by a tab

[silvermail]

Hello guys,

Been trying to get this to work but to no avail...

I have a CSV file that goes like this:

pid hostname c1 c2 c3 status date time message
123456 serverA 0 0 0 54058938 20100301 033412 Error with Transfer

I am trying to parse the fields date and time and I have specified something like this in my props.conf

TIME_PREFIX = \w+\s\w+\s\w+\s\w+\s\w+\s\w+\s
TIME_FORMAT = %Y%m%d %H%M%S

But I couldn't get the date/time indexed correctly.

But if I change my original log source to be 20100301033412 (without the space in-between), it works fine.

Has anyone solved this before? Any response is much appreciated. Thanks.

[silvermail · Accepted solution]

Ah, got it.

It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S (with a tab and not a space as the CSV is using tab delimeter).

[silvermail]

I did use \t and I believe it will work as well. Will try %t next time if I run into any issues. Thanks!

[gkanapathy]

I believe you can use %t in the time formats to represent any white space, including a tab character. I am not sure if \t would work specifically for a tab character, but there is a good chance it will.