Splunk Search

TIME FORMAT

saad_siddiqi
Path Finder

Hi,

I have got a CDR file having entires as under, and I am trying to set the RECORD_DATE as the time stamp of event.
Can any one help me out with the TIME_PREFIX regex

VWARS-9-1-9017-1370646409-51569:ENGINE_ID=1|CP_ID=2|SEQUENCE_NUMBER=669356430|EDR_TYPE=52|RECORD_DATE=20130607230709|MESG=Welcome_Back|NUMBER=1233445555

I have tried below mentioned but not availing anything.

TIME_PREFIX = ^(?i)|RECORD_DATE=
TIME_PREFIX = (?i)|RECORD_DATE=(?P[^|]+)

Thanks a bunch

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Your first won't work because you have a caret sign (^) at the beginning, meaning Splunk should look at the start of the line.

The second won't work because you've included a field extraction syntax as used by rex. This is not used at all (or supported) by TIME_FORMAT.

Also you've specified your regexes to be case insensitive through the initial (?i), you probably don't want that. It won't BREAK anything but still.

Your first TIME_PREFIX should work just fine if you remove the ^ character (and optionally, remove (?i) as well).

View solution in original post

gfuente
Motivator

Hello

You almost got it, this one works:

TIME_PREFIX =\|RECORD_DATE=

Regards

saad_siddiqi
Path Finder

Thanks this worked

0 Karma

Ayn
Legend

Your first won't work because you have a caret sign (^) at the beginning, meaning Splunk should look at the start of the line.

The second won't work because you've included a field extraction syntax as used by rex. This is not used at all (or supported) by TIME_FORMAT.

Also you've specified your regexes to be case insensitive through the initial (?i), you probably don't want that. It won't BREAK anything but still.

Your first TIME_PREFIX should work just fine if you remove the ^ character (and optionally, remove (?i) as well).

saad_siddiqi
Path Finder

Thanks a lot for the elaborative explanation. That helped a lot

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...