Hello guys,
Been trying to get this to work but to no avail...
I have a CSV file that goes like this:
pid hostname c1 c2 c3 status date time message
123456 serverA 0 0 0 54058938 20100301 033412 Error with Transfer
I am trying to parse the fields date and time and I have specified something like this in my props.conf
TIME_PREFIX = \w+\s\w+\s\w+\s\w+\s\w+\s\w+\s
TIME_FORMAT = %Y%m%d %H%M%S
But I couldn't get the date/time indexed correctly.
But if I change my original log source to be 20100301033412 (without the space in-between), it works fine.
Has anyone solved this before? Any response is much appreciated. Thanks.
Ah, got it.
It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S
(with a tab and not a space as the CSV is using tab delimeter).
Ah, got it.
It should be TIME_FORMAT = %Y%m%d<tab>%H%M%S
(with a tab and not a space as the CSV is using tab delimeter).
I did use \t and I believe it will work as well. Will try %t next time if I run into any issues. Thanks!
I believe you can use %t
in the time formats to represent any white space, including a tab character. I am not sure if \t
would work specifically for a tab character, but there is a good chance it will.