Getting Data In

How to parse NSi autostore logs? Timestamps without leading zeros or spaces.

af93yjym
New Member

We want to collect NSi autostore logs in Splunk. Unfortunately Splunk is not able to parse the logs by default.

Log example:

5/28/2015^13:3:5:6^r_source_700 1^STATUS MESSAGE^Object ID: 125478
5/28/2015^13:3:5:6^r_source_700 1^STATUS MESSAGE^E-Mail: 
5/28/2015^13:3:5:23^r_source_700 1^STATUS MESSAGE^SAP XYZ: Entering Component.
5/28/2015^13:3:5:25^r_source_700 1^STATUS MESSAGE^SAP XYZ: 1 documents to Route.

The Datetime contains no leading zeros or spaces. The format is:
day/month/year^hour:minute:second:millisecond

We tried to parse the Time with: TIME_FORMAT=%-m/%-d/%Y^%-H:%-M:%-S:%-N but it did not worked.

Does someone knows a possibility to parse that kind of Timestamp?

Thank you in advance
Lars

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the timestamp format is correct, the TIME_FORMAT string %m/%d/%Y^%H:%M:%S:%N works for me.

---
If this reply helps you, Karma would be appreciated.
0 Karma

af93yjym
New Member

Unfortunatly not for us. Is there any tool which parses the logs and gives some information about the parsing results?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I used Splunk. Put a copy of your log on the Splunk server. Go to Settings->Data Inputs and click "Add New" next to "Files". Browse to the location of your log file and click Open. The Data Preview window will show how Splunk parses the log. Select the Timestamps tab to tell Splunk how to parse your time format.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you sure about the timestamp format? There is no 28th month in our current calendar.

---
If this reply helps you, Karma would be appreciated.
0 Karma

af93yjym
New Member

You are right. I meant month/day/year, of course.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...