Splunk Search

How to configure props.conf for timestamp recognition and extraction for 2 log files with different timestamp structures?

gyarici
Path Finder

Hi,

I have two different type log files using in Splunk and I do not have any timestamp issue with the first one (date/month/year hout:minute:second). But the other log file timestamp structure is like below which I have an issue to extract timestamp from the line.

Here it is:

DAY:16;MONTH:3;YEAR:2014;HOUR:7;MINUTE:34;SECOND:18;MILLISECOND:38;good:11111;bad:111;...... etc.....

I have already had proper working prop.conf file with the first log file type. Do I need to change or add any additonal time prefix in to prop conf?

In preview mode, I tried various different prefix structure without success.
TIME_PREFIX =DAY:\d{2};MONTH:\d{2};YEAR:\d{4};HOUR:\d{2};MINUTE:\d{2};SECOND:\d{2};MILLISECOND:\d{2};

Could you please help to figure this out?

Thanks

Gokhan

1 Solution

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

View solution in original post

sowings
Splunk Employee
Splunk Employee

I was able to get most of the way there with the following setting in props.conf:


TIME_FORMAT = DAY:%d;MONTH:%m;YEAR:%Y;HOUR:%H;MINUTE:%M;SECOND:%S;MILLISECOND:%N
TIME_PREFIX = ^

I got 38 hundredths of a second instead of 38 thousandths with this config, so you might have to tweak the millisecond bit.

NOTE: You would place this within your props.conf in a stanza for your sourcetype, e.g. [your_type].

gyarici
Path Finder

Great!. It means I should add into props.conf with different sourcetype.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...