striptime not parsing time stamps

[smudge797]

Im having trouble with data previewer not recognizing the striptime in my logs. Any help would be much welcome! Thanks in advance.

In my props.conf have tried:

[test_data]
TIME_FORMAT=%d %b %Y %H:%M:%S,%3N
TIME_PREFIX 😃 

Sample data:

FATAL http-bio-7779-exec-12 com.mydomain.bux.common.client.HttpServiceInvoker (HttpServiceResult.java:90) 30 Aug 2013 00:24:16,407 - Http Service Calling Failed. Http Calling Context: 

FATAL http-bio-7779-exec-12 com.mydomain.bux.common.client.HttpServiceInvoker (HttpServiceResult.java:90) 30 Aug 2013 00:24:16,431 - Http Service Calling Failed. Http Calling Context: 

FATAL http-bio-7779-exec-12 com.mydomain.bux.common.client.HttpServiceInvoker (HttpServiceResult.java:90) 30 Aug 2013 00:24:16,437 - Http Service Calling Failed. Http Calling Context: 

ERROR http-bio-7779-exec-12 com.mydomain.bux.webservice.callstoactionsvc.serviceclients.MyServiceClientImpl (LoggingUtils.java:56) 30 Aug 2013 00:24:16,475 - CallsToActionSvcException occurs when trying to process the reqeust.

ERROR http-bio-7779-exec-12 com.mydomain.bux.webservice.callstoactionsvc.serviceclients.YourServiceClientImpl (LoggingUtils.java:56) 30 Aug 2013 00:24:16,525 - CallsToActionSvcException occurs when trying to process the reqeust.

ERROR http-bio-7779-exec-12 com.mydomain.bux.webservice.callstoactionsvc.serviceclients.MyServiceClientImpl (LoggingUtils.java:56) 30 Aug 2013 00:24:16,569 - CallsToActionSvcException occurs when trying to process the reqeust.

FATAL http-bio-7779-exec-12 com.mydomain.bux.common.client.HttpServiceInvoker (HttpServiceResult.java:90) 30 Aug 2013 00:24:30,316 - Http Service Calling Failed. Http Calling Context: 

FATAL http-bio-7779-exec-12 com.mydomain.bux.common.client.HttpServiceInvoker (HttpServiceResult.java:90) 30 Aug 2013 00:24:30,323 - Http Service Calling Failed. Http Calling Context: 

[kristian_kolb]

The TIME_FORMAT looks OK, and these are all just single line events, right? And the timestamp will always come within the first 150 characters of the event, right?

The only thing left to test should be to escape the closing parenthesis in your TIME_PREFIX, as parentheses have special meaning in regex, and also add that whitespace for good measure;

TIME_PREFIX = \)\s

And you are aware that this change will only affect new events coming in for indexing. You might have to restart splunk, since this affects index-time operations.

Hope this helps,

K

[smudge797]

Worked great thanks!

[kristian_kolb]

Please mark it as answered if your problem was solved. Vote up if you want to.

Thanks,
K

[smudge797]

Work great thanks!

[rturk]

Hi Smudge,

Try this:

[test_data]
MAX_TIMESTAMP_LOOKAHEAD = 200
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %d %b %Y %H:%M:%S,%3N

I think your problem is that on some lines the timestamp is more than 150 characters into the event (which by default is where Splunk will search to.

Let me know how you get along 🙂

Ref: http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Configuretimestamprecognition#Timestamp_attri...

[kristian_kolb]

Good point on the SHOULD_LINEMERGE part. Didn't look like it was past the 150-mark to me, though.