Getting Data In

Extracting event date/time from record with multiple date/times

garryclarke
Path Finder

I have a data input with the following format for which I am struggling to extract the correct data for the SPLUNK event date and time.

MAIN|^0212345678-2|^6.75|^GBP|^2014-12-16|^2014-12-12 12:27:22|^1

The date time field I want to use for the event time is 2014-12-12 12:27:22 however SPLUNK seems to be using a combination of different fields to build the event date and time. For the above record it is deducing an event date and time of 2014-12-16 12:27:22. It seems to be deriving the date from field 5 and the time from field 7. Ultimately I would like the date and time to be derived only from field 7 i.e. 2014-12-12 12:27:22

I have tried various permutations of the following in my props.conf but still remain unsuccessful.

TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=(?i)^(?:[^\^]*\^){7}
MAX_TIMESTAMP_LOOKAHEAD=50

Any ideas on what to try next would be much appreciated.

Tags (1)
0 Karma
1 Solution

mzorzi
Splunk Employee
Splunk Employee

This works for me:

[event_sourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=^(?:[^\^\n]*\^){5}
MAX_TIMESTAMP_LOOKAHEAD=50

Make sure the event has a sourcetype associated and utilise that sourcetype name in the props.conf

View solution in original post

mzorzi
Splunk Employee
Splunk Employee

This works for me:

[event_sourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=^(?:[^\^\n]*\^){5}
MAX_TIMESTAMP_LOOKAHEAD=50

Make sure the event has a sourcetype associated and utilise that sourcetype name in the props.conf

garryclarke
Path Finder

Thanks mzorzi for pointing me in the right direction. I guess I need to spend a bit more time with my regular expressions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...