Getting Data In
Highlighted

Timestamp extraction from log

Champion

Hello,
I am trying to extract time stamp from log file which will help me to use log TimeStamp instead of splunk time stamp.

I have tried to match the time using regex in props.conf but the regex is not at all showing the date. I have tried everything but Splunk doesn't recognize the log date. Please guide me as am not an regex expert.

TIME_PREFIX=^\d{4}:\d{1,2}:\d{1,2}-\d{1,2}:\d{1,2}

sample log:

2013:6:18-11:18 -- IP:: 10.121.230.155 REQUEST URI:: www...
Tags (2)
0 Karma
Highlighted

Re: Timestamp extraction from log

Path Finder

I'm pretty sure you should be editing TIMEFORMAT, not TIMEPREFIX. Not only that, you aren't specifying which fields are year, month, etc.

0 Karma
Highlighted

Re: Timestamp extraction from log

Champion

Hello,
below gave me the solution 🙂

DATETIMECONFIG=NONE
NO
BINARYCHECK=1
TIME
FORMAT=%y:%m:%d-%H:%M

View solution in original post

Highlighted

Re: Timestamp extraction from log

Path Finder

DATETIMECONFIG=NONE this is wrong there is no attribute like that find correct one below
DATETIME
CONFIG=NONE

0 Karma