Getting Data In

How to ask splunk to extract time_stamp only if time string is at the start of a line?

houxiaoxiao
Engager

I tried to put the "TIME_PREFIX = ^" at props.conf at system/default, system/local, myapp/default, myapp/local but none of them is working. What should I do?

Tags (2)

bbingham
Builder

I think you may need to add more to your solution. By default, splunk will already will start looking at the start of a line for the timestamp. I think what you may be looking for will be achieved by using MAX_TIMESTAMP_LOOKAHEAD in conjunction with what you have. By default splunk looks from the start of a line, then looks up to 150 char in the event for a timestamp. By adjusting MAX_TIMESTAMP_LOOKAHEAD, you can control how far into an event splunk looks for the timestamp. If you use something like the following:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 10

Splunk will start on the first character, and count up to 10 more characters for a timestamp. Adjust your MAX_TIMESTAMP_LOOKAHEAD to fit your timestamp syntax and splunk will be forced to match your timestamp at the start of the line.

Hope that helps

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...