How to configure props.conf for timestamp recognition and extraction for 2 log files with different timestamp structures?

[gyarici]

Hi,

I have two different type log files using in Splunk and I do not have any timestamp issue with the first one (date/month/year hout:minute:second). But the other log file timestamp structure is like below which I have an issue to extract timestamp from the line.

Here it is:

DAY:16;MONTH:3;YEAR:2014;HOUR:7;MINUTE:34;SECOND:18;MILLISECOND:38;good:11111;bad:111;...... etc.....

I have already had proper working prop.conf file with the first log file type. Do I need to change or add any additonal time prefix in to prop conf?

In preview mode, I tried various different prefix structure without success.
TIME_PREFIX =DAY:\d{2};MONTH:\d{2};YEAR:\d{4};HOUR:\d{2};MINUTE:\d{2};SECOND:\d{2};MILLISECOND:\d{2};

Could you please help to figure this out?

Thanks

Gokhan

[sowings · Accepted solution]

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^


I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

[gyarici]

Great!. It means I should add into props.conf with different sourcetype.

Thanks for your help.