Hello,
My log files looks like this :
"1","I","R","140406 233102","E","0","1341874",[...]
I want Splunk to recognize the date and time from this log.
The date uses the following format : "YYMMDD HHMMSS"
("140406 233102" ==> 2014 June 6th, 23h31m02s)
Can someone help me to find the regex ?
Thanks
Try this (props.conf)
[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1
Try this (props.conf)
[yourSourceType]
TIME_FORMAT=%y%m%d %H%M%S
TIME_PREFIX=\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"[a-zA-Z0-9]+\",\"
NO_BINARY_CHECK=1
This one worked for me.
Thank you !
You'll want to set these in props.conf:
[your_sourcetype]
TIME_PREFIX = ","
MAX_TIMESTAMP_LOOKAHEAD = 14
TIME_FORMAT = %y%m%d %H%M%S
Depending on the rest of your sourcetype's special needs there may be more to set, but this should take care of your timestamp.
I'll try it as soon as possible.
Thanks !