timestamp lookahead

[sarit_s]

Hello

i have this event for example:

$changeSystemTimeCmd 1533808153 -newTime 1533808153 -oldTime 1533808147

i need to set the timestamp to take the first number after the first string. in this can it is

$changeSystemTimeCmd

but it can be any string.
i tried with timestamp lookahead 30 but the problem is that i can't know what will be the length of this first string
how can i set timestamp lookahead regex to take the first number after first string ?

[harsmarvania57 · Accepted solution]

Hi,

You can use below configuration on Indexer/Heavy Forwarder whichever comes from UF to setup timestamp at index time if you don't have any whitespace in first string.

props.conf

[yoursourcetype]
TIME_FORMAT=%s
TIME_PREFIX=^(?:[^\s]+)\s
MAX_TIMESTAMP_LOOKAHEAD=10

[sarit_s]

i don't have indexer or HF
im running on all in one configuration so the sourcetype configuration located on props.conf in the app

it is working ! can you please explain why MAX_TIMESTAMP_LOOKAHEAD=10 ?

[harsmarvania57]

If you are running standalone splunk instance then also it will work. I have tested same config in Add Data in my lab splunk instance and it is working for me.

MAX_TIMESTAMP_LOOKAHEAD will count after TIME_PREFIX, in above config TIME_PREFIX regex cover till first whitespace so this $changeSystemTimeCmd is captured with TIME_PREFIX regex and after that you have 10 digit epoch time format so I have given 10 in MAX_TIMESTAMP_LOOKAHEAD

[sarit_s]

thanks for your answer
it is working

i see it is also work without MAX_TIMESTAMP_LOOKAHEAD
the thing is that im afraid that the epoch time will be with more than 10 digits so if it is not necessary to limit i think it will be better

what do you think ?

[harsmarvania57]

If you do not set MAX_TIMESTAMP_LOOKAHEAD then it will take default value which is 128 character, I'll suggest to define MAX_TIMESTAMP_LOOKAHEAD with max length of your epoch time.