Changing collection of the timestamp of the event?

[brandili]

Hello,

I have a problem I'm not able to solve.

I'm getting information from a server where two timestamp appear. Splunk is considering the first timestamp of the log. However, I would like Splunk consider only the second timestamp in the log line. How do I get splunk to recognize the second timestamp? Follows the example of the log below:

First timestamp - - - - -Second timestap

2014-07-09 10:22:00 - 2014-07-10 07:15:10 4 100 Notice License: License leased to user BRA01

2014-07-09 10:22:00 - 2014-07-10 07:15:02 4 100 Notice CAL usage: Using CAL of type "Named User" for user "BRA01"

Thanks.

[richgalloway]

Add a TIME_PREFIX statement to the appropriate stanza of your props.conf file.

TIME_PREFIX = .{22}

should tell Splunk to skip the first 22 characters before looking for a timestamp.