Splunk Search

Source using ISO Date

cvajs
Contributor

v4.3.1 on sles 11.1

i have some syslog-ng data, written to file as template("$DATE $TZ $WEEKDAY $ISODATE $HOST $FACILITY [$LEVEL] $MSG\n")

when i try to create a new source and use ISO Date YYYY-MM-DDTHH:MM:SS.MMM-HH:MM for timestamp format it doesnt find the pattern, keeps locking onto the $DATE format.

why?

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

You'll want to look at props.conf, specifically TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD and maybe TIME_FORMAT.

0 Karma

sowings
Splunk Employee
Splunk Employee

In the Manager when defining a new sourcetype (in particular, the timestamp tab), TIME_PREFIX corresponds to "Timestamp is always prefaced by a pattern". Since you're writing a "normal" syslog timestamp first, Splunk is finding that. You'll need to specify a regex pattern that matches the "normal" time stamp, so that Splunk will look past this prefix to find the ISO time stamp instead.

TIME_FORMAT is the "Specify timestamp format (strptime)" text entry box. I've successfully used %Y-%m-%dT%H:%M:%S%z.

0 Karma

cvajs
Contributor

i was using the GUI to create a new source definition, etc. when i went to timestamp tab i could not get the GUI to recognize the iso date in the data.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...