Splunk Search

Source using ISO Date

cvajs
Contributor

v4.3.1 on sles 11.1

i have some syslog-ng data, written to file as template("$DATE $TZ $WEEKDAY $ISODATE $HOST $FACILITY [$LEVEL] $MSG\n")

when i try to create a new source and use ISO Date YYYY-MM-DDTHH:MM:SS.MMM-HH:MM for timestamp format it doesnt find the pattern, keeps locking onto the $DATE format.

why?

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

You'll want to look at props.conf, specifically TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD and maybe TIME_FORMAT.

0 Karma

sowings
Splunk Employee
Splunk Employee

In the Manager when defining a new sourcetype (in particular, the timestamp tab), TIME_PREFIX corresponds to "Timestamp is always prefaced by a pattern". Since you're writing a "normal" syslog timestamp first, Splunk is finding that. You'll need to specify a regex pattern that matches the "normal" time stamp, so that Splunk will look past this prefix to find the ISO time stamp instead.

TIME_FORMAT is the "Specify timestamp format (strptime)" text entry box. I've successfully used %Y-%m-%dT%H:%M:%S%z.

0 Karma

cvajs
Contributor

i was using the GUI to create a new source definition, etc. when i went to timestamp tab i could not get the GUI to recognize the iso date in the data.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...