Getting Data In

Can't extract simple YYYYMMDD data to be event date...

philip_wong
Communicator

I have PSV files in such format. Date is in 2nd column.
Haven't spent much time to try different setting, but Splunk still took file modified time as event time stamp. I'm stilling asking myself what's wrong with "TIME_FORMAT= %Y%m%d"??

Anyone can help to see what's wrong of my props.conf?

foo|20131201|bar|...

[unixops:sitelog]
SHOULD_LINEMERGE = false
TIME_FORMAT= %Y%m%d
LEARN_MODEL = false
INDEXED_EXTRACTIONS = PSV
FIELD_NAMES = host,date,log,message_type,region,city,campus,building,status,personality

Tags (2)
1 Solution

philip_wong
Communicator

It works now. A silly mistake...

I didn't pay attention TIME_PREFIX is regex based.
So the answer is

TIME_PREFIX = \|

Thanks helping me!

View solution in original post

philip_wong
Communicator

It works now. A silly mistake...

I didn't pay attention TIME_PREFIX is regex based.
So the answer is

TIME_PREFIX = \|

Thanks helping me!

strive
Influencer

Good to know that it worked. Dont forget to accept the answer 🙂

strive
Influencer

In your case, you need to set TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD. Check the props.conf documenattion
http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Propsconf

TIME_PREFIX = foo|

MAX_TIMESTAMP_LOOKAHEAD = 12

Try these. Change the values as required.

strive
Influencer

Can you tell what will be there before |20131201. Is it one word or multiple words separated by |.

0 Karma

philip_wong
Communicator

"foo" is not fixed value.

I did try TIME_PREFIX = | and MAX_TIMESTAMP_LOOKAHEAD = 50 , still didn't work

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...