Getting Data In

what would be the perfect props.conf for this event

abhishekkalokhe
Explorer

Date=2020-02-10|StrtTime=09:56:08|EndTime=09:56:08|Duration=7|EvntType=MSG|UUID=

props that i am using :

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = Date=\d+-\d+-\d+
TRUNCATE = 9999
SHOULD_LINEMERGE = false
CHARSET=UTF-8
disabled=false

can i use TIME_FORMAT = %Y-%m-%d OR do i have to use TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

0 Karma
1 Solution

nickhills
Ultra Champion

Set the prefix to exclude "date=": TIME_PREFIX = ^Date=
Set the lookahead so it only catches the first time: MAX_TIMESTAMP_LOOKAHEAD = 28
Your timeformat example should (i think) work: TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Set the prefix to exclude "date=": TIME_PREFIX = ^Date=
Set the lookahead so it only catches the first time: MAX_TIMESTAMP_LOOKAHEAD = 28
Your timeformat example should (i think) work: TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!