Getting Data In

Need help on TIME_FORMAT and TIME_PREFIX

sathiyasun
Explorer

I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break the LINE_BREAK from the first line. Please help.

Error when i try to upload the log: ( "Could not use strptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime)

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+:\w+\s\w+\s=\s\w+:\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @sathiyasun,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N.
The TIME_PREFIX setting should not be "\s" as none of the timestamps in your sample event are preceded by a space. Perhaps TIME_PREFIX = : will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @sathiyasun,

What is the timestamp in your sample data :2018-08-27 14:28:06,382 OR 2018-08-27 14:28:15,000?

0 Karma

sathiyasun
Explorer

This is the date &timestamp
DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

I am assuming that you have multi line events in that case please try with TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N , TIME_PREFIX = ^(?s)(?:[^\:]*\:){2} and SHOULD_LINEMERGE = true in props.conf on Indexer or Heavy forwarder whichever comes first from UF.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...