Splunk Search
Highlighted

Unable to read date properly from a mysql-log file

I have a file something like below:

140215  4:07:49 [Note] Plugin 'FEDERATED' is disabled.
140215  4:07:49  InnoDB: Initializing buffer pool, size = 8.0M
etc.

140215 id basically the date as 15thFeb2014 but splunk is not able to read the date instead , its reading everything as event, however it does able to read the time perfectly and showing timestamp as 3/25/14 4:07:49.000 AM and 3/25/14 4:07:49.000 AM respectively(here we can see the dates are incorrect but times are correct) for the two records. I have tried regular expressions to get the date correctly but its only highlighting the time part and not able to read the date part.If anyone knows how the handle such kinds of dates in splunk then please help.

Thanks

Tags (2)
0 Karma
Highlighted

Re: Unable to read date properly from a mysql-log file

SplunkTrust
SplunkTrust

Try adding "TIME_FORMAT=%y%m%d %k:%M:%S" to your props.conf file.

---
If this reply helps you, an upvote would be appreciated.
0 Karma