Define the best sourcetype for this timestamp

[leandromatperei]

Guys.

I have the following log that I need to index in Splunk, breaking each line, what would be the best sourcetype for this log format?

TIME=20201031064817502 started|src=NSS|UCPU=0|SCPU=0
TIME=20201031064817506||LUSED=1|LMAX=138|OMAX=-1|LFEAT=osr_swirec,dtmf,osr_rec_tier4|UCPU=125|SCPU=31
TIME=20201031064854505 EVNT=SWIepst|VERSION=11.0.3.2019061409|UCPU=5703|SCPU=250

The format is year, month, day, hours, minutes, seconds, mseconds 

[isoutamo · Accepted solution]

Hi

you need to define your own sourcetype for this log format.  For time you should use in props.conf

TIME_PREFIX = TIME=
TIME_FORMAT = %Y%m%d%H%M%S%3Q

r. Ismo