Splunk Search

Date / time format (regex help)

zebu14
Explorer

Hello,

My log files looks like this :

"1","I","R","140406 233102","E","0","1341874",[...]

I want Splunk to recognize the date and time from this log.

The date uses the following format : "YYMMDD HHMMSS"
("140406 233102" ==> 2014 June 6th, 23h31m02s)

Can someone help me to find the regex ?

Thanks

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this (props.conf)

[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1
0 Karma

zebu14
Explorer

This one worked for me.

Thank you !

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll want to set these in props.conf:

[your_sourcetype]
TIME_PREFIX = ","
MAX_TIMESTAMP_LOOKAHEAD = 14
TIME_FORMAT = %y%m%d %H%M%S

Depending on the rest of your sourcetype's special needs there may be more to set, but this should take care of your timestamp.

0 Karma

zebu14
Explorer

I'll try it as soon as possible.
Thanks !

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...