Getting Data In

Parsing time failing

Sqig
Path Finder

Hi. I have done a good amount of reading on this, and it seems to be a popular subject both in the documentation and on the Answers site. Still, I'm rather stumped.

We have logs where each line starts with a date/time stamp in the format

YYYYmmdd HHMMSS hostname lots of other data

So

20110711 145022 myhost yadda yadda yadda

Splunk combines as many of these lines into one event as it can. We have tried adding the following to Props.conf on the Indexers but have had no success.

TIME_FORMAT = %Y%m%d %H%M%S
TZ = US/Eastern
MAX_EVENTS=1
SHOULD_LINEMERGE = false

Also tried TIME_FORMAT = ^%Y%m%d %H%M%S

Is this likely just a regex problem?

Other elements of the props.conf stanza are honored and acted upon when the data is indexed.

Given the simplicity of the timestamp and its presence at the very beginning of the line, I would think this would be easy to solve. Do we need to look at a custom datetime.xml file?

Thanks for any guidance.

0 Karma

Sqig
Path Finder

btool shows that the parameters described above are, in fact, being applied. I don't know of anything else I can check.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Your properties look right. I suppose I would question and check whether they are being applied to the incoming data.

0 Karma

Sqig
Path Finder

Thanks for the suggestion. At first, I thought this worked (!!) but a closer look showed that I was seeing additional results not related to the logs in quesiton.

When restricting my search properly, I'm still seeing the same problem I was before.

0 Karma

ccannon1
Engager

Try adding a TIME_PREFIX element which tells Splunk where to look for the time.

TIME_PREFIX = ^
TIME_FORMAT = %Y%m%d %H%M%S
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...