Getting Data In

Timestamp extraction from log

linu1988
Champion

Hello,
I am trying to extract time stamp from log file which will help me to use log TimeStamp instead of splunk time stamp.

I have tried to match the time using regex in props.conf but the regex is not at all showing the date. I have tried everything but Splunk doesn't recognize the log date. Please guide me as am not an regex expert.

TIME_PREFIX=^\d{4}:\d{1,2}:\d{1,2}-\d{1,2}:\d{1,2}

sample log:

2013:6:18-11:18 -- IP:: 10.121.230.155 REQUEST URI:: www...
Tags (2)
0 Karma
1 Solution

linu1988
Champion

Hello,
below gave me the solution 🙂

DATE_TIMECONFIG=NONE
NO_BINARY_CHECK=1
TIME_FORMAT=%y:%m:%d-%H:%M

View solution in original post

linu1988
Champion

Hello,
below gave me the solution 🙂

DATE_TIMECONFIG=NONE
NO_BINARY_CHECK=1
TIME_FORMAT=%y:%m:%d-%H:%M

thambisetty_bal
Path Finder

DATE_TIMECONFIG=NONE this is wrong there is no attribute like that find correct one below
DATETIME_CONFIG=NONE

0 Karma

cschmidt0121
Path Finder

I'm pretty sure you should be editing TIME_FORMAT, not TIME_PREFIX. Not only that, you aren't specifying which fields are year, month, etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...