Getting Data In

Extract timestamp in db2audit

edwardman88
Explorer

Hi, I need Splunk to recognize the timestamps down to microseconds.

A sample event is listed below

"2014-06-03-18.30.02.188462","SYSADMIN","DB2AUDIT",2,0,"","dsbdbadm","DSBDBADM",,,"*LOCAL.dsbdbadm.140603103002","db2audit",,,,,,,,,,,,,,,

test]
TIME_PREFIX = ^"
TIME_FORMAT = %Y-%m-%d-%H.%M.%S.%6N

But didn’t work.
Any suggestion?

Thanks.

Tags (1)
0 Karma

edwardman88
Explorer

I try to change the setting

In the props.conf
[test]
SHOULD_LINEMERGE=false
TIME_FORMAT=\"%Y-%m-%d-%H.%M.%S.%6N\"
In the inputs.conf

[monitor:///audit/03/instance/audit.del]
sourcetype = test
source = sat
index = sat

But splunk still can't get the log

We try delete the microseconds in the audit.del, the splunk can get the log.

Please advise!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This worked fine with your sample data

[timetest]
SHOULD_LINEMERGE=false
TIME_FORMAT=\"%Y-%m-%d-%H.%M.%S.%6N\"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried omitting TIME_PREFIX?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...