Getting Data In

Timestamp parsing with separate Date and Time fields

tread_splunk
Splunk Employee
Splunk Employee

Hi there,

My event data has the following extract about 100chars in from the start of the event...

&ltdate_value&gt2015-08-30T00:00:00&lt/date_value&gt&lttime_value&gt23:58:52&lt/time_value&gt&ltagency&gtMCP&lt/agency&gt

I'm trying to get Splunk to construct the event timestamp value as 2015-08-30 23:58:52.

I've tried various forms of the following in PROPS.CONF...

TIME_FORMAT = YYYY-MM-DDT00:00:00&lt/date_value&gt<time_value>&lttime_value&gtHH:MM:SS

TIME_PREFIX = &ltdate_value&gt

Suggestions greatly appreciated.
Tony.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The TIME_FORMAT attribute must use strptime() metacharacters. Try this:

MAX_TIMESTAMP_LOOKAHEAD = 200
TIME_PREFIX = <date_value>
TIME_FORMAT = %Y-%m-%DT00:00:00</date_value><time_value>%H:%M:%S
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The TIME_FORMAT attribute must use strptime() metacharacters. Try this:

MAX_TIMESTAMP_LOOKAHEAD = 200
TIME_PREFIX = <date_value>
TIME_FORMAT = %Y-%m-%DT00:00:00</date_value><time_value>%H:%M:%S
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

antlefebvre
Communicator

I changed the %D to %d to make this work. Thanks @richgalloway

0 Karma

tread_splunk
Splunk Employee
Splunk Employee

Thanks @richgalloway. Spot on.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.