Splunk Search

time_format help

AzmathShaik
Path Finder

Hello All,

i have source with events

****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:01:30
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4029676352*vwxmsghdlr.cpp*03523*08000*2020DEC22*13:58:54
Partition not defined for this node:

 

can someone help me in writing TIME_PREFIX and LINE_BREAKER? 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!