Here is my DNS raw data:
Oct 17 19:47:09 ns1 named[15517]: 17-Oct-2013 19:47:09.314 queries: client xxx.xxx.xxx.xxx#57938: query: mail.server.domain.com IN A + (xxx.xxx.xxx.xxx)
When I do data preview Splunk has this as the timestamp;
"19:47:09 ns1 named[15517]: 17-Oct-2013"
I don't know if I should use this "Oct 17 19:47:09" OR "17-Oct-2013 19:47:09.314"
Which ever one I use I don't know the regex to use for the extraction.
Also there is the question about braking. If I use the second one, I can't break before the timestamp.
Any help would be great.
You can use the first one, or parts of it, to anchor LINE_BREAKER
the you can use TIME_PREFIX
to anchor the timestamp extractor. Example:
LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
SHOULD_LINEMERGE = false
TIME_PREFIX = \]:\s
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
You can use the first one, or parts of it, to anchor LINE_BREAKER
the you can use TIME_PREFIX
to anchor the timestamp extractor. Example:
LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
SHOULD_LINEMERGE = false
TIME_PREFIX = \]:\s
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
I used TZ = UTC and this worked OK
HELP if you can.
I used this in the props.conf
[dns]
LINE_BREAKER = ([\r\n]+)\w+\s\d+\s[\d:]+
NO_BINARY_CHECK = 1
TZ = America/Chicago
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
TIME_PREFIX = \]:\s
pulldown_type = 1
This is not taking the Time Zone for some reason
Help if you can
Wow you are good and fast as well thanks for the help.