Getting Data In

How to limit date timestamp parsing view?

gbowden_pheaa
Path Finder

I have a proxy server that is double date stamping events. This is not normally an issue, but I ran into a hydridization of these dates when the 2 date stamps differ:

  Jul 27 23:59:59 name01 name01.coname.dom: <Mon, 28 Jul 2014 00:00:00,EDT> xxxpayloadxxx

Splunk date-stamped this event as 7/28/2014 23:59:59. We are utilizing Splunk's default time stamp parsing for this source.

I want Splunk to stop looking for a date after 16 characters. My understanding for the max_timestamp_lookahead in props.conf tells Splunk where to start, not stop.

Any guidance is appreciated. Thanks

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can specify this:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 16

The prefix tells it where to start, and the lookahead where to stop. Additionally, you could specify an appropriate TIME_FORMAT.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can specify this:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 16

The prefix tells it where to start, and the lookahead where to stop. Additionally, you could specify an appropriate TIME_FORMAT.

gbowden_pheaa
Path Finder

Awesome - thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...