My log file looks like below. I need Splunk to ID the time_of_stop time -- instead of the the time included with the date of stop prefixed with T
Should I use the field extractor to extract the T00:00:00
? The time essentially is in two places and I want Splunk to grab the second one...
/_4mse-ku6q/1747516"> date of stop 2015-07-08T00:00:00 date of stop time of stop18:20:00time of stopMCP1st district, Rockville
Try something like this (props.conf on Indexer/HF)
[YourSourceType]
TIME_FORMAT=%Y-%m-%dT00:00:00 date of stop time of stop%H:%M:%S
TIME_PREFIX=date of stop\s+
MAX_TIMESTAMP_LOOKAHEAD=53
...Other settings....
Try something like this (props.conf on Indexer/HF)
[YourSourceType]
TIME_FORMAT=%Y-%m-%dT00:00:00 date of stop time of stop%H:%M:%S
TIME_PREFIX=date of stop\s+
MAX_TIMESTAMP_LOOKAHEAD=53
...Other settings....
This worked great with some minor tweaks! THANKS
Hi @jpelletier
Glad you found a solution through @somesoni2 🙂 Don't forget to resolve yours posts by clicking "Accept" directly below the answer that best addressed your question. Also, be sure to upvote other users' answers/comments that helped you out to award them karma points. It's also good practice to share the final configuration with your minor tweaks so others are aware of the exact solution that worked for you. Thanks!