Getting Data In

time zone in time format

surekhasplunk
Communicator

Hi my time in the log file is something like this.
How to write the regex for timestamp format.
As am getting error failed to parse timestamp

[29/Mar/2019:06:04:57 +0530]

Tags (2)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi

Please use below config in props.conf

TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
TIME_PREFIX = \[

If above config will not work then please provide some sample data with full events (Mask any sensitive data)

0 Karma

surekhasplunk
Communicator

Hi @harsmarvania57

I tried the same but not working...

For reference my access.log file looks like this.

"time_stamp" "auth_user" src_ip status_code "req_line" "categories" "rep_level" "media_type" bytes_to_client bytes_from_client "user_agent" "virus_name" "block_res" "application_name"
 [29/Mar/2019:06:04:57 +0530] "" 176.6.60.56 403 "GET http://abcd.com/HTTP/1.1"; "Software/Hardware" "Minimal Risk" "" 8811 237 "Microsoft-CryptoAPI/6.1" "" "0" ""
 [29/Mar/2019:06:04:57 +0530] "asharma072315" 176.6.50.55 200 "POST https://obdefw.com/HTTP/1.1"; "Web Mail" "Minimal Risk" "" 1208 7687 "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.9126; Pro)" "" "0" ""

I need to add props and transforms.conf for the same file and create and new source_type i think. As i dont find any generic sourcetype which supports this kind of log file.

Please help.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If you have timestamp [29/Mar/2019:06:04:57 +0530] in above raw data enclosed with " like this "[29/Mar/2019:06:04:57 +0530]" then you can use below configuration. Are there any chance to encoded timestamp with " ?

props.conf

[yoursourcetype]
FIELD_DELIMITER = space
TIMESTAMP_FIELDS = time_stamp
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Do you mean you need setting/parameter on Indexer in props.conf to identify timestamp correctly from raw data ?

0 Karma

surekhasplunk
Communicator

yes @harsmarvania57

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...