Splunk Search

PROPS Config...Different Time Formats within Same Source File

SplunkDash
Motivator

Hello,

I am a source file which has  events with 2 different file formats. How would I write  TIME_FOMAT for my PROPS Configuration file. any help will be highly appreciated. Thank you..

 

2021/05/30 16:28:12    JAVA_OPTION_USESERVERCIPHERSUITESORDER:-DuseServerCipherSuitesOrder=true

2021/05/30 16:28:12    JAVA_OPTION_XMX:-Xmx196m

2021-05-30 16:28:27.872  INFO 28709 --- [           main] .c.r.b.i.e.ConsulBootstrapPropertyLoader

2021-05-30 16:28:43.677  INFO 28709 --- [           main] com.sas.studio.ApplicationPetrichor

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot have more than one TIME_FORMAT setting for a sourcetype.  Sometimes, different time formats means different sourcetypes, but that's not always the case.

If you truly have multiple timestamp formats in the same source type then, first, slap the developer.  Ask the admin if timestamp formats are adjustable.  Finally, give up on TIME_FORMAT and let the datetime.xml file parse the times for you.  It's less than ideal, but probably the best you can do.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...