Dear All,
I stuck at silly thing i am not able to plot regular expression for 2014-09-11/06:00:01.708/EDT My Regex is : ^\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}
2014-09-11/06:00:01.708/EDT
^\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}
But this is not working can anyone tell me where i an going wrong here.
Thanks
When importing your data, specify the timestamp string in strptime format. This one worked for me using your example:
%Y-%m-%d/%H:%M:%S.%3N/%Z
Per the note above, if you're using Data Preview, should use strptime formatting. Docs: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Modifyeventprocessing#Timestamps
Hello MuS,
Its not working for me. i am trying set Timestamp on Data Preview.
Thanks Gajanan
did you check the docs http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Configuretimestamprecognition ?
Hello Mus, I have tried without ^ bu no luck. its simple but i dont know where i am going wrong
This works on all those online regex testers .... try not to use any ^ or other special signs in the regex.
^
this works up til the timezone, if you need the TZ as well try this:
\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}\/\w+
or a bit more compact regex like this:
(\d{2,4}[\-\/\:\.])+\w+
