Splunk Search

TIME_PREFIX for props

SplunkDash
Motivator

Hello, how can I write TIME_PREFIX for props conf file for following sample event. Any help will be highly appreciated. Thank you, greatly appreciated.

 

INFORMATION:Metadata Deployment process started at Tue Jun 16 11:51:47 EDT 2020.

INFORMATION:Metadata Deployment process ended at Tue Jun 16 11:51:48 EDT 2020.

INFORMATION:Metadata Deployment process ended at Tue Jun 16 11:51:49 EDT 2020

  

Labels (1)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash  Try this works only for sample events provided having fixed spaces and Alpha-numeric.

TIME_PREFIX = ^INFORMATION:\w+\s\w+\s\w+\s+\w+\s\w+\s

---

An upvote would be appreciated if this reply helps!

 

0 Karma

SplunkDash
Motivator

Thank you so much appreciated. What about if I use

TIME_PREFIX=at+\s 

Since # of words are not the same, but there always "at+\s" before the Date/Time. But, please let me know if you have any recommendation other than this.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...