Re: Timestamp detection fails - Splunk Community

Getting Data In

I try to parse out the timestamp of this line:

Jun  3 17:39:09 svlog.myserver.net svdcdev 04/29/2013 09:14:37 AM   LogName=Security    SourceName=Microsoft Windows security auditing.

I tried the following format during the input creation > Data Preview > Timestamp:

%m/%d/%Y %I:%M:%S %p

What is wrong with this format definition?

I hat to define a prefix to tell him, that he should not try to parse the first occuring but the second occuring timestamp:

TIME_PREFIX=[^\s]+[\s]+[^\s]+ [^\s]+ [^\s]+ [^\s]+

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...