Splunk Search

time_format help

AzmathShaik
Path Finder

Hello All,

i have source with events

****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:01:30
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4029676352*vwxmsghdlr.cpp*03523*08000*2020DEC22*13:58:54
Partition not defined for this node:

 

can someone help me in writing TIME_PREFIX and LINE_BREAKER? 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>