Hello All,
i have log events, in which my time stamp looks like
superuser:02/13/2019 04:08:24:367 PM UTC
supportUser:02/13/2019 02:06:23:497 PM UTC
auditUser:02/13/2019 09:04:44:367 PM UTC
libSMAL:02/13/2019 03:08:29:300 PM UTC
and i defined TIME_PREFIX as TIME_PREFIX=^: .
Can some please tell me if i defined it correctly?
Thanks
Hello @AzmathShaik,
^: will not work, because ^ refers to the beginning of the line and there are no colons at the beginning of your lines.
Also, you should specify TIME_FORMAT. Splunk will try to recognize the time format on its own, but that can be error-prone.
Instead, try it like this:
TIME_PREFIX = \w+:
TIME_FORMAT = %m/%d/%Y %H:%M:%S:%3N %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 64