Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

datetime.xml problem with a word "hour"

$
0
0

I have a non - standard timestamp that I want to extract. The value after the word Hour is the actual hour of the day in military time so 0 is between 12 and 1am...and so on and so forth til hour 23. Don't care about minutes or seconds.

Splunkd is not spitting out any debug info, but it is not braking it up.

Example 1: August 13, 2013, Hour 0 300:A 1

Example 2: August 13, 2013, Hour 1 300:A general

here is my complete datetime.xml

alt text

Why is this not working? I hard coded the actual Month "August" to test make sure it was not my regex, but it is all mashing the events into one

Here is my props.conf:

alt text

Here is what it looks like in splunk:

alt text


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>