Splunk Search

Date / time format (regex help)

zebu14
Explorer

Hello,

My log files looks like this :

"1","I","R","140406 233102","E","0","1341874",[...]

I want Splunk to recognize the date and time from this log.

The date uses the following format : "YYMMDD HHMMSS"
("140406 233102" ==> 2014 June 6th, 23h31m02s)

Can someone help me to find the regex ?

Thanks

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1
0 Karma

zebu14
Explorer

This one worked for me.

Thank you !

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll want to set these in props.conf:

[your_sourcetype]
TIME_PREFIX = ","
MAX_TIMESTAMP_LOOKAHEAD = 14
TIME_FORMAT = %y%m%d %H%M%S

Depending on the rest of your sourcetype's special needs there may be more to set, but this should take care of your timestamp.

0 Karma

zebu14
Explorer

I'll try it as soon as possible.
Thanks !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...