Getting Data In

Timeparsing issues

walsborn
Path Finder

Hello all,

I'm having a time parsing issue that I don't know how to fix and am looking for some help.

My inputs on the syslog looks like this:

[monitor]
index = *
no_appending_timestamp = true
host_segment = 5
disabled = false

My Props for this source type is configured by a TA.  But the problem I'm having in the logs were from changes in our syslog system.

The new log looks like Dec 14 08:50:19 bxxm-itb.net.xxx.xxx 1,2021/12/14 08:50:18,

How do I configure props to tell splunk to ignore the first timestamp, skip the host fqdn and then parse the second time?

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @walsborn,

you have to add to your props.conf the following options:

[your_sourcetype]
TIME_PREFIX = ,
TIME_FORMAT = %Y/%m/%d %H:%M:%S

Ciao.

Giuseppe

View solution in original post

walsborn
Path Finder

That did it @gcusello , thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @walsborn,

you have to add to your props.conf the following options:

[your_sourcetype]
TIME_PREFIX = ,
TIME_FORMAT = %Y/%m/%d %H:%M:%S

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...