Getting Data In

Timestamp configuration does not pull the correct timestamp

iherre312
Explorer

I am importing cisco logs that have two timestamps with different formats.
Unfortunately, configuration set in props.conf for the app is still not pulling extracting the correct date.
Here is a sample:

<splunk system timestamp> Aug 23 12:00:00 xxxx.org: <second timestamp> 2016 Sept 28 12:34:53 EDT

[test]
TIME_PREFIX = org :\s*
#TIME_FORMAT = %Y %b %d %H:%M:%S %Z
MAX_TIMESTAMP_LOOKAHEAD = 75
Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It seems to me, you do not need the TIME_PREFIX option, since the format of the different fields is, well, different.

You do want to use the TIME_FORMAT setting, which does look correct.

The TIME_PREFIX listed in your config would not work, due to the space in between the org and the :. You can correct the TIME_PREFIX , and your input should start working.

alacercogitatus
SplunkTrust
SplunkTrust

Please accept either answer if we have answered your question. Thanks!

0 Karma

lguinn2
Legend

Looks like there is a space between "org" and ":" in your props.conf TIME_PREFIX, but not in your data.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...