Getting Data In

access log index



I am planning to index one of the access.log file. which has data like below first line header and next two lines two example data.

"time_stamp" "auth_user" src_ip status_code "req_line" "categories" "rep_level" "media_type" bytes_to_client bytes_from_client "user_agent" "virus_name" "block_res" "application_name"
[29/Mar/2019:06:04:57 +0530] "" 403 "GET"; "Software/Hardware" "Minimal Risk" "" 8811 237 "Microsoft-CryptoAPI/6.1" "" "0" ""
[29/Mar/2019:06:04:57 +0530] "asharma072315" 200 "POST"; "Web Mail" "Minimal Risk" "" 1208 7687 "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.9126; Pro)" "" "0" ""

But while trying to inidex it splunk says time format is incorrect/invalid.

Can you please suggest the props.conf and transforms.conf for this log file.

in my inputs.conf i have mentioned something like this:
disabled = 1
source_type = accesslog
index = accesslog

0 Karma