TIME FORMAT

[saad_siddiqi]

Hi,

I have got a CDR file having entires as under, and I am trying to set the RECORD_DATE as the time stamp of event.
Can any one help me out with the TIME_PREFIX regex

VWARS-9-1-9017-1370646409-51569:ENGINE_ID=1|CP_ID=2|SEQUENCE_NUMBER=669356430|EDR_TYPE=52|RECORD_DATE=20130607230709|MESG=Welcome_Back|NUMBER=1233445555

I have tried below mentioned but not availing anything.

TIME_PREFIX = ^(?i)|RECORD_DATE=
TIME_PREFIX = (?i)|RECORD_DATE=(?P[^|]+)

Thanks a bunch

[gfuente]

Hello

You almost got it, this one works:

TIME_PREFIX =\|RECORD_DATE=

Regards

[saad_siddiqi]

Thanks this worked

[Ayn · Accepted solution]

Your first won't work because you have a caret sign (^) at the beginning, meaning Splunk should look at the start of the line.

The second won't work because you've included a field extraction syntax as used by rex. This is not used at all (or supported) by TIME_FORMAT.

Also you've specified your regexes to be case insensitive through the initial (?i), you probably don't want that. It won't BREAK anything but still.

Your first TIME_PREFIX should work just fine if you remove the ^ character (and optionally, remove (?i) as well).

[saad_siddiqi]

Thanks a lot for the elaborative explanation. That helped a lot