Default _time

[camah4]

I have an example log file with the following format:

Nov 05 10:33:37 servername applicationserver: instance,ipaddress,[05/Nov/2011:10:33:33 +0000]

I would like the second time column which contains [05/Nov/2011:10:33:33 +0000] to be column which is used for _time at index time, currently by default it uses Nov 05 10:33:37.

Any suggestion on how to tech splunk to use the alternative timestamp for _time would be appreciated.

Thanks

[tgow]

Here is an example of a props.conf that could work:

[yoursourcetype]
TIME_PREFIX = ,\[
TIME_FORMAT = %d/%h/%Y:%T

You might need to change this depending on if you are using a 24-hour clock or not.

[Takajian]

You can extract timestamp as you want. Please see following manual. This will help your question.

http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Configuretimestamprecognition

[DUThibault]

Version 4.2.4 is long dead. This link still works as of version 7.2.6 : https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition