TimeStamp problem

[geantvert007]

Hi,

I have a timestamp problem on Splunk.
I am working with log file who looks like :

numberline;date;ipsrc;ipdst
102;13Jan2015;10.10.10.10;12.12.12.12

On splunk the date is 15 january but on the raw date we are in 13 january ...
I know that I have to configure propers.config,date_time.xml ect but what is the command to extract the date without space correctly ?

Thanks

Steve

[renjith_nair · Accepted solution]

If you are trying to extract the date from your event, ie 13Jan2015, you can use

[<spec>]
TIME_PREFIX = \d{3};
TIME_FORMAT = %d%b%Y

where spec can be host,source,sourcetype

Reference : http://docs.splunk.com/Documentation/Splunk/6.1/Data/Configuretimestamprecognition

[geantvert007]

Thanks renjith.nair,
I will try this.

On the splunk document they talk about the props.conf but I have use the local or the default props.config to enable the extraction ?

[renjith_nair]

For all your configuration, use local. Also please not that you might need to adjust the time prefix regex to match all your events