Splunk Search

How to configure props.conf for timestamp recognition and extraction for 2 log files with different timestamp structures?

gyarici
Path Finder

Hi,

I have two different type log files using in Splunk and I do not have any timestamp issue with the first one (date/month/year hout:minute:second). But the other log file timestamp structure is like below which I have an issue to extract timestamp from the line.

Here it is:

DAY:16;MONTH:3;YEAR:2014;HOUR:7;MINUTE:34;SECOND:18;MILLISECOND:38;good:11111;bad:111;...... etc.....

I have already had proper working prop.conf file with the first log file type. Do I need to change or add any additonal time prefix in to prop conf?

In preview mode, I tried various different prefix structure without success.
TIME_PREFIX =DAY:\d{2};MONTH:\d{2};YEAR:\d{4};HOUR:\d{2};MINUTE:\d{2};SECOND:\d{2};MILLISECOND:\d{2};

Could you please help to figure this out?

Thanks

Gokhan

1 Solution

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

View solution in original post

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

gyarici
Path Finder

Great!. It means I should add into props.conf with different sourcetype.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...