I'm having trouble recognizing the timestamp for a logs with this structure,
(field timestamp appears = none in Splunk fields column)
DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,760 (?:?) - Performing a clean update ...
DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,761 (?:?) - Delete Query: delete bla_bla
INFO [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,797 (?:?) - Records processed - total: 9, inserted: 9, skipped: 0
DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,808 (?:?) -
My props.conf
[spring_output]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE = true
TIME_FORMAT = %d %b %Y %H:%M:%S,%3N
# Breaking events on lines like: "DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker:3] 09 Dec 2014 22:00:03,949"
TIME_PREFIX = ^\s*([A-Z])\w+ \[.*]\s+
MAX_TIMESTAMP_LOOKAHEAD=1
TZ=EST
BREAK_ONLY_BEFORE=^FATAL|^DEBUG|^ERROR|^INFO|^TRACE|^WARN|^ WARN|^ INFO|^CRIT|^ CRIT
MAX_EVENTS = 99999
TRUNCATE = 0
Really unsure why Splunk was choking on this but rebuilding it from anew has it now working as expected.
cat local/props.conf [spring_output] BREAK_ONLY_BEFORE = ^FATAL|^DEBUG|^ERROR|^INFO|^TRACE|^WARN|^ WARN|^ INFO|^CRIT|^ CRIT MAX_TIMESTAMP_LOOKAHEAD = 1 NO_BINARY_CHECK = 1 TIME_FORMAT = %d %b %Y %H:%M:%S,%3N TIME_PREFIX = ^\s*([A-Z])\w+ \[.*]\s+ TZ = EST pulldown_type = 1
Really unsure why Splunk was choking on this but rebuilding it from anew has it now working as expected.
cat local/props.conf [spring_output] BREAK_ONLY_BEFORE = ^FATAL|^DEBUG|^ERROR|^INFO|^TRACE|^WARN|^ WARN|^ INFO|^CRIT|^ CRIT MAX_TIMESTAMP_LOOKAHEAD = 1 NO_BINARY_CHECK = 1 TIME_FORMAT = %d %b %Y %H:%M:%S,%3N TIME_PREFIX = ^\s*([A-Z])\w+ \[.*]\s+ TZ = EST pulldown_type = 1
Thanks somesoni2,
could have omitted that as it's only meant to speed up the indexing after I get the timestamp recognition working.
Unfortunately removing it still results in Splunk recognising 0 timestamps.
Just get rid of this
AX_TIMESTAMP_LOOKAHEAD=1