Date / time format (regex help)

[zebu14]

Hello,

My log files looks like this :

"1","I","R","140406 233102","E","0","1341874",[...]

I want Splunk to recognize the date and time from this log.

The date uses the following format : "YYMMDD HHMMSS"
("140406 233102" ==> 2014 June 6th, 23h31m02s)

Can someone help me to find the regex ?

Thanks

[somesoni2 · Accepted solution]

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1

[zebu14]

This one worked for me.

Thank you !

[martin_mueller]

You'll want to set these in props.conf:

[your_sourcetype]
TIME_PREFIX = ","
MAX_TIMESTAMP_LOOKAHEAD = 14
TIME_FORMAT = %y%m%d %H%M%S

Depending on the rest of your sourcetype's special needs there may be more to set, but this should take care of your timestamp.

[zebu14]

I'll try it as soon as possible.
Thanks !