Getting Data In

Time Format Help

rlaan
Path Finder

I am looking for help figuring out how to represent the following timestamp as a prefix for parsing time/start of events. this is contained in some logs i was provided today and am having difficulty figuring out how to get pas the "o'clock" contained within the log files. these are new logs that were indexed under an existing sourcetype that already had a working/existing timestamp format.

Old format: (majority of logs)
[2021-02-23T14:37:26.659-07:00]

New/abnormal format: (some weird new stuff) 
<23-Feb-2021 2:21:41 o'clock PM MST>

I am trying to figure out how best to capture the new format logs from the existing sourcetype and redirect them into the proper timestamp configuration or a new sourcetype of their own.

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @rlaan,

You can use below time format;

TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @rlaan,

You can use below time format;

TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
If this reply helps you an upvote is appreciated.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!