Timestamp extraction props.conf

[aaronkorn]

Hello,

We have the following timestamp in our log but are unsure how to edit the props.conf to pick it up:

The format is MM/DD HH:MM YY

IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION
AA8AB241 0115010113 T O OPERATOR OPERATOR NOTIFICATION
BF05CF18 0115010013 I H pt3rmt04079 AAA5
BF05CF18 0115010013 I H pt3rmt04074 AAA5
BF05CF18 0115010013 I H pt3rmt04071 AAA5
BF05CF18 0115010013 I H pt3rmt04055 AAA5
BF05CF18 0115010013 I H pt3rmt04050 AAA5
BF05CF18 0115010013 I H pt3rmt04049 AAA5
BF05CF18 0115010013 I H pt3rmt04042 AAA5
BF05CF18 0115010013 I H pt3rmt04038 AAA5
BF05CF18 0115010013 I H pt3rmt04031 AAA5
BF05CF18 0115010013 I H pt3rmt04030 AAA5

[martin_mueller]

You may be looking for this:

TIME_FORMAT=%m%d%H%M%S
TIME_PREFIX=^\S+\s+

Note, the prefix may be wrong for other types of data you have. It just skips over the first word.

[martin_mueller]

Works for me when taking your sample data into the data inputs preview.

[aaronkorn]

This didnt seem to do it.