Splunk Search

How to configure props.conf for timestamp recognition and extraction for 2 log files with different timestamp structures?

gyarici
Path Finder

Hi,

I have two different type log files using in Splunk and I do not have any timestamp issue with the first one (date/month/year hout:minute:second). But the other log file timestamp structure is like below which I have an issue to extract timestamp from the line.

Here it is:

DAY:16;MONTH:3;YEAR:2014;HOUR:7;MINUTE:34;SECOND:18;MILLISECOND:38;good:11111;bad:111;...... etc.....

I have already had proper working prop.conf file with the first log file type. Do I need to change or add any additonal time prefix in to prop conf?

In preview mode, I tried various different prefix structure without success.
TIME_PREFIX =DAY:\d{2};MONTH:\d{2};YEAR:\d{4};HOUR:\d{2};MINUTE:\d{2};SECOND:\d{2};MILLISECOND:\d{2};

Could you please help to figure this out?

Thanks

Gokhan

1 Solution

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

View solution in original post

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

gyarici
Path Finder

Great!. It means I should add into props.conf with different sourcetype.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...