DNS time stamp REGEX needed

[hartfoml]

Here is my DNS raw data:

Oct 17 19:47:09 ns1 named[15517]: 17-Oct-2013 19:47:09.314 queries: client xxx.xxx.xxx.xxx#57938: query: mail.server.domain.com IN A + (xxx.xxx.xxx.xxx)

When I do data preview Splunk has this as the timestamp;

"19:47:09 ns1 named[15517]: 17-Oct-2013"

I don't know if I should use this "Oct 17 19:47:09" OR "17-Oct-2013 19:47:09.314"

Which ever one I use I don't know the regex to use for the extraction.

Also there is the question about braking. If I use the second one, I can't break before the timestamp.

Any help would be great.

[_d_ · Accepted solution]

You can use the first one, or parts of it, to anchor LINE_BREAKER the you can use TIME_PREFIX to anchor the timestamp extractor. Example:

LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
SHOULD_LINEMERGE = false
TIME_PREFIX = \]:\s
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N

[hartfoml]

I used TZ = UTC and this worked OK

[hartfoml]

HELP if you can.

I used this in the props.conf

[dns]
LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
NO_BINARY_CHECK = 1
TZ = America/Chicago
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
TIME_PREFIX = \]:\s
pulldown_type = 1


This is not taking the Time Zone for some reason

Help if you can

[hartfoml]

Wow you are good and fast as well thanks for the help.