Getting Data In

Need help on Timestamp extraction while parsing the log data at Indexer

maniu1609
Path Finder

I have a log file to be monitored and i need to extract timestamp.
Example events:
Fri Feb 02 2018 10:22:37 aaaaaaa bbbbbbb cccccc
Mon Feb 05 2018 11:00:50 gggggg aaaaaaa vvvvvv

Please help me how I can extract timestamp of the events. Thanks in advance!!

0 Karma
1 Solution

TISKAR
Builder

Hello you can use that in props.conf,

[ __auto__learned__ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d %Y %H:%M:%S
TIME_PREFIX=\w{3}\s

View solution in original post

TISKAR
Builder

Hello you can use that in props.conf,

[ __auto__learned__ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%b %d %Y %H:%M:%S
TIME_PREFIX=\w{3}\s

maniu1609
Path Finder

Hi Tiskar,

Thanks for your time. May I know what's the use of SHOULD_LINEMERGE and NO_BINARY_CHECK.
I have gone through the splunk documents but unable to understand them. Can you please give me some examples to understand.

0 Karma

TISKAR
Builder

Hi,
Yes, A binary file is a file whose content must be interpreted by a program or a hardware processor that understands in advance exactly how it is formatted LIKE file.exe.
So When set NO_BINARY_CHECK to true, Splunk processes binary files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...