Timestamp recognition - nonstandard time field

[bregan_2]

Hi, I have a problem with timestamp recognition in the following logs:

The originating log source outputs records (pipe delimited) with the following as timestamps :

20170701|200009|
20170701|20009|
20170701|2009|
20170701|209|
20170701|29|
20170701|9|

As you can see, the logs do not have leading zeros if the time is for example "00:00:09 AM", the logs would output as "9"

I know how to solve this during search time by doing some evals and zeropadding and then using strptime.
However, what options do i have to solve this during INDEXING time?

Thought of doing a transform and creating a newfield however i quickly realised timestamp recognition is done before transforms.conf.

strptime only has %k for single digit HOURS, I've run out of ideas for a custom datetime.xml.
Would appreciate any help on this.

Thank you

[DalJeanis]

Try setting that sourcetype up with three different timestamp formats, in order, with the first assuming there are seconds only, the second assuming minutes and seconds, and the third assuming hours minutes and seconds. You will need to include the trailing pipe symbol into the format to make that work, so it would be something like this...

[timeattempt1]
%Y%m%d\|%S\|

[timeattempt2]
%Y%m%d\|%M%S\|

[timeattempt3]
%Y%m%d\|%H%M%S\|

[bregan_2]

It's HHMMSS except it takes away all leading zeros if it's 000009.

[bregan_2]

It's HHMMSS except it takes away all leading zeros if it's 000009.

[jplumsdaine22]

Do all those timestamps represent "00:00:09 AM", ? It''s not clear what they mean.

[bregan_2]

It's HHMMSS except it takes away all leading zeros. E.g 000009 would be 9.

200009 would be 20:00:09

[jplumsdaine22]

So what is 2009 is also 20:00:09 ? Like I said it's not really clear what the rule is. Or does it strip tailing 0s as well.

And is |9 09:00:00 ?