Splunk Search

Unable to read date properly from a mysql-log file

pradeep6kumar
Engager

I have a file something like below:

140215  4:07:49 [Note] Plugin 'FEDERATED' is disabled.
140215  4:07:49  InnoDB: Initializing buffer pool, size = 8.0M
etc.

140215 id basically the date as 15thFeb2014 but splunk is not able to read the date instead , its reading everything as event, however it does able to read the time perfectly and showing timestamp as 3/25/14 4:07:49.000 AM and 3/25/14 4:07:49.000 AM respectively(here we can see the dates are incorrect but times are correct) for the two records. I have tried regular expressions to get the date correctly but its only highlighting the time part and not able to read the date part.If anyone knows how the handle such kinds of dates in splunk then please help.

Thanks

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adding "TIME_FORMAT=%y%m%d %k:%M:%S" to your props.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...