Hello,
I am trying to extract time stamp from log file which will help me to use log TimeStamp instead of splunk time stamp.
I have tried to match the time using regex in props.conf but the regex is not at all showing the date. I have tried everything but Splunk doesn't recognize the log date. Please guide me as am not an regex expert.
TIME_PREFIX=^\d{4}:\d{1,2}:\d{1,2}-\d{1,2}:\d{1,2}
sample log:
2013:6:18-11:18 -- IP:: 10.121.230.155 REQUEST URI:: www...
Hello,
below gave me the solution 🙂
DATE_TIMECONFIG=NONE
NO_BINARY_CHECK=1
TIME_FORMAT=%y:%m:%d-%H:%M
Hello,
below gave me the solution 🙂
DATE_TIMECONFIG=NONE
NO_BINARY_CHECK=1
TIME_FORMAT=%y:%m:%d-%H:%M
DATE_TIMECONFIG=NONE this is wrong there is no attribute like that find correct one below
DATETIME_CONFIG=NONE
I'm pretty sure you should be editing TIME_FORMAT, not TIME_PREFIX. Not only that, you aren't specifying which fields are year, month, etc.