i have a file with field date like 03/08/2016 09:25 GMT+02:00
My sourcetype doesn't work with
%d/%m/%Y %H:%M %Z%z
\d{2}/\d{2}/\d{4} \d{2}:\d{2} \d{2}:\d{2}
I have Failed to parse timestamp. defaulting to file modtime
Thanks
Do you have any control over how the field is written? Splunk expects offsets in hhmm format rather than hh:mm.
Also, the regex string in your question doesn't match the sample date. Try \d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}
it doens't work.
the message is :
could not use strptime to parse timestamp from ....
failed to parse timestamp
One does not use regular expressions with strptime
. I'm not sure what you're doing with it. I just wanted to point out it doesn't match your data.
In fact, i want to create a sourcetype to read my file. I selected Advance to define Format timestamp and Prefix timestamp. At this point, i have my parsing error.
That's probably because of the odd timestamp format. Do you have the ability to change it?
I've never seen %Z
and %z
used together in a format string. Have you tried %d/%m/%Y %H:%M %Z
?
Yes, i have.
It doesn't work too.
That brings us back to my first question, which hasn't been answered.
Can the date format be changed?
I can't change the date format in the file. 😞
This file is create by nother system and i'm not ability to change it.
Then you may have to use SED within your props.conf file to change the field to a recognized format.
how can do that ?
In the props.conf stanza for your sourcetype put:
SEDCMD-timestamp=s/\d{2}\/\d{2}\/\d{4} \d{2}:\d{2} [A-Z]{3}\+\d{2}:\d{2}/\1\2\3/g
This should convert the timestamp into %m/%d/%Y %H:%S%Z
format.