Can you help me write the time prefix?

[AzmathShaik]

Hello All,

i have log events, in which my time stamp looks like

superuser:02/13/2019 04:08:24:367 PM UTC
supportUser:02/13/2019 02:06:23:497 PM UTC
auditUser:02/13/2019 09:04:44:367 PM UTC
libSMAL:02/13/2019 03:08:29:300 PM UTC

and i defined TIME_PREFIX as TIME_PREFIX=^: .

Can some please tell me if i defined it correctly?

Thanks

[whrg]

Hello @AzmathShaik,

^: will not work, because ^ refers to the beginning of the line and there are no colons at the beginning of your lines.

Also, you should specify TIME_FORMAT. Splunk will try to recognize the time format on its own, but that can be error-prone.

Instead, try it like this:

TIME_PREFIX = \w+:
TIME_FORMAT = %m/%d/%Y %H:%M:%S:%3N %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 64