Help me with Time formt and time prefix

[shreya17]

I need help to write time format and time prefix for below  timelogs. Please note these are seperate logs, hence need different timeformat and timeprefix for all three. Help will be appreciated, Thanks in advance!

####<30/06/2021 11:13:08,975 PM AEST>

####<Jul 3, 2021 4:25:41,233 PM AEST>

[2021-07-06T23:59:58.849+10:00]

Trying to get this added in props.conf file in below format, need assistance with timeformat and timeprefix

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = 
TIME_PREFIX =

[burwell]

Hi. Instead of us just providing you with the answer, do you want to take a crack at the timestamp settings?

Here are documented examples on the date/time format settings: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Examples

I also came across this handy video that shows you how to interact with Splunk and test these settings.

 https://www.youtube.com/watch?v=Q5EWCT79nZ4

Give the settings a try and let us know what works/doesn't work or that you have questions about. Thanks!

[shreya17]

Hey @burwell  I did give a try. Let me know if this is good.

####<30/06/2021 11:13:08,975 PM AEST>

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %d/%m/%Y %I:%M:%S,%3N %p
TIME_PREFIX = \####<

####<Jul 3, 2021 4:25:41,233 PM AEST>

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %b %d, %Y %I:%M:%S,%3N %p
TIME_PREFIX = \####<

[2021-07-06T23:59:58.849+10:00]  -- (not sure of this one)

DATETIME_CONFIG =
NO_BINARY_CHECK = true
TZ = Australia/Sydney
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N  
TIME_PREFIX = \[

[burwell]

@shreya17  Great job!

I tested these and they seem correct.

A couple of settings I like to add

• MAX_TIMESTAMP_LOOKAHEAD .. make it be the total number of characters in the time including timezone etc
• SHOULD_LINEMERGE=false
• LINE_BREAKER=([\r\n]+)..     This one you put the regular expression that matches the beginning of an event. That way if there's some garbage lines they won't be treated as single events (if you want that) e.g. for 2 of your events it would be LINE_BREAKER=([\r\n]+\####<
• TRUNCATE=9999 or whatever you want. The maximum line length you will accept