Value misinterpreted as time

[amielke]

We found the following message in the data and Splunk recognizes it as a timestamp. How can I prevent this interpretation and add it to the event before it?

parameters: :I1:=1109002298;

thx

[woodcock]

Never, ever let splunk guess time details. Use these props.conf settings:

[YourSourcetypeHere]
TIME_PREFIX = 
TIME_FORMAT = 
MAX_TIMESTAMP_LOOKAHEAD = 

[amielke]

We found a solution for us:

[your_sourcetype]
BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
DATETIME_CONFIG =
LINE_BREAKER = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

[nickhills]

Your best bet is to configure a specific timestamp lookahead/format and event break options.
To give you a bit more help are you able to share a few complete events?

[amielke]

We try "TIME_FORMAT", but:
The logfile has a second eventtype included (unordered mix 😞 😞

********** first log of session at 2018-12-14 09:31:42,793
message
*********

In this case only the timestamp upstairs is found, not the second time (*** first log of...) format.

If we not use the "TIME_FORMAT", splunk regognize both timeformats and the unwanted value.

[nickhills]

In that case 🙂
Use this:

MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L

[amielke]

This is the full event:

2018-12-14 09:01:42,793
statement:
SELECT t0.id,t0.name1 FROM DUMMY t0, DUMMY2 t1
 WHERE (t0.id = :I1) AND (t1.id = t0.id
)
parameters: :I1:=1109002298;
CPL Stacktrace - Start ...
CPL Stacktrace - End

2018-12-14 09:01:43,793
NEW EVENT

[nickhills]

In props.conf add the following to the stanza for your sourcetype.

TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L