Getting Data In

Setting the time the event occured

sklass
Path Finder

Hi all,

I am streaming TCP data into splunk which comes in the format of this.

timestamp="09/15/2008 21:16:46" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2056" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2261" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 
timestamp="09/15/2008 21:16:47" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2058" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2284" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" 

But when I'm looking at the data in Splunk it's not parsing the Time correctly. It's using the Time (column) it was uploaded as opposed to the timestamp which is what I want. This is some historical data that we want to parse out.

Now I thought I would need to create a props.conf in my (otherwise empty) project which I did and I did notice a slight change but I can't get the timestamp field to set the time..

Here is the contents of my current prop.conf.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
LINE_BREAKER = [\r\n]
SHOULD_LINEMERGE= false
MAX_EVENTS=1

Can someone show me the errors I'm creating? Thanks!!

Tags (1)
0 Karma

linu1988
Champion

Hello,
Please try this.

[icm_data]
EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?"
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT = %m/%d/%Y %H:%M:%S
BREAK_ONLY_BEFORE = timestamp
MAX_DAYS_AGO = 5000
SHOULD_LINEMERGE= false

Thanks

0 Karma

linu1988
Champion

updated the answer try this..

0 Karma

sklass
Path Finder

Hi there - Hey thanks - It's still not working. Can you explain two things:
- If you see some other year it takes the year.
- need to check in datetime.xml file in etc folder

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...