If year, month, day, hour, minute, and second are all different comma separated fields in my data, how do I assign the timestamp for a new sourcetype?

[SilviaGebel]

Hi,

I am trying to create a new sourcetype in order to get the timestamp right.
Year, month, day, hour, minute, second are different fields and comma separated, that's why Splunk does not recognize it as a timestamp.

This is my data:

2;2014;1;10;5;36;39;4;0;0;1;0;2;0;0;0;0;0;0;0;0;0;0;200;200,46301
3;2014;1;10;5;26;15;4;0;0;1;0;2;0;0;0;0;0;0;0;0;0;0;200;200,27934
4;2014;1;10;0;8;11;4;0;0;1;0;2;0;0;0;0;0;0;0;0;0;0;200;200,69374
5;2014;1;9;23;57;43;0;0;0;1;2;2;0;0;0;0;0;0;0;0;0;0;105;109,28964

The times i want to extract as timestamp are in this format:

2;%H;%m;%d;%H;%;M;%S;...
so for the first event: 10.01.2014 05:36:39 ( %Y.%m,%d %H:%M:%S ) as final format.

Where and what do I have to insert at advanced settings for timestamp configuration when creating a new sourcetype?

Thank's for your help!

Silvia

[jeffland · Accepted solution]

You could define the timestamp for the sourcetype in your props.conf by adding the following stanza:

[Sourcetype_Name]
TIME_FORMAT = %Y;%m;%e;%k;%M;%S
MAX_TIMESTAMP_LOOKAHEAD = 25
category = Custom
disabled = false
pulldown_type = true

This will give you an option to explicitly select Sourcetype_Name in the list of sourcetypes you see while adding your data, so you can confirm it's working (I'm not sure about the strptime variables, whether they work like this with and without leading zeros). See here for more information.

[SilviaGebel]

Ok, thank you. But can you please tell me how to get to props.conf?

[jeffland]

For global settings, go to the props.conf in %splunk_home%/etc/system/local/.

[SilviaGebel]

and where do I find this? 😉

[jeffland]

Assuming you are on linux and have installed splunk in the default folder, that would be /opt/splunk/etc/system/local/.