On the indexer, I have the following property config:
[host::newdatamine]
TIME_PREFIX = ^[INFO|ERROR|WARN]\s+[
TIME_FORMAT = %y.%m.%d\s+%H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]
example logfile:
[INFO] [12.02.27 17:00:24] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog
[INFO] [12.02.27 17:00:42] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-26
Splunk now breaks the lines correctly and picks up the correct date. It does not pick up the correct time:
Splunk output:
1 2/29/12
12:02:29.000 PM
[INFO] [12.02.29 19:00:43] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog
* host=NEWDATAMINE Options|
* sourcetype=newdatamine-too_small Options|
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log Options
2 2/29/12
12:02:29.000 PM
[INFO] [12.02.29 15:21:28] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-28
* host=NEWDATAMINE Options|
* sourcetype=newdatamine-too_small Options|
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log Options
It looks like my mistake was thinking that TIME_FORMAT would do rex (regular expressions). Per docs, it doesn't look like it can... Resolved via the following:
[host::newdatamine]
TIME_PREFIX = ^[[A-Z]+]\s[
TIME_FORMAT = %y.%m.%d %H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]