FlexConnector Timestamp Conversion - SharePoint ULS Log

[klr01]

I have a need to process data from SharePoint ULS logs using a custom FlexConnector. I am having trouble converting the timestamp in these logs properly.

An example of a timestamp in the ULS log is:      03/29/2016 18:34:02.68

My sdkfilereader.properties file looks like:

token[2].name=ULS_DateTime

token[2].type=String

event.deviceReceiptTime=__createOptionalTimeStampFromString(ULS_DateTime,"MM/DD/yyyy HH:mm:ss.SSS")

The ESM's deviceReceiptTime field is returning a timestamp of: 29 Jan 2016 18:34:02 GMT

Does anyone have any idea why the month would not be converting properly? The rest of the timestamp converts fine. Any suggestions would be much appreciated.

Thank you!

[klr01]

I was able to get a little closer. I updated the .sdkfilereader.properties to:

event.deviceReceiptTime=__createOptionalTimeStampFromString(ULS_DateTime,"MM/dd/yyyy HH:mm:ss.SSS")

I did not realize that "DD" represented the day in the year not the day of the month. Now I am getting: 29 Mar 2016 17:34:02 GMT

So now, I'm only off by 1 hour. Any suggestions are appreciated.

Thanks!

[klr01 · Accepted solution]

I found a solution. Because there is no time zone specified in the timestamp provided in the ULS logs, the FlexConnector kept parsing the time 1 hour behind.

I updated the .sdkfilereader.properties to:

event.deviceReceiptTime=__createOptionalTimeStampFromString(__concatenate(ULS_DateTime,"Z"),"MM/dd/yyyy HH:mm:ss.SSSX")

where I concatenated a "Z" to represent UTC/GMT to force the timestamp to be parsed in the proper time zone.

[skrc851]

Hi , I've got something to ask on a flex parser I've been working today, kindly let me know what am I missing..

My Timestamp: 2016-09-06T17:25:57 ----- I need to map this to endTime

Attempt 1:

token[0].name=ET ,     token[0].type=TimeStamp ,     token[0].format=yyyyMMddTHH\:mm\:ss 
event.endTime=ET---------------- Unsuccessful

Attempt 2:

token[0].name=ED , token[0].type=String , 

token[1].name=ET ,  token[1].type=String
All the below were not returning any values – I mean the fields are just empty-no values seen and no errors seen as well - ---------------- Unsuccessful

a. event.deviceReceiptTime=__createOptionalTimeStampFromString(__concatenate(ED," ",ET),"yyyyMMdd HH\:mm\:ss")

b. event.deviceCustomDate1=__createOptionalTimeStampFromString(__concatenate(ED," ",ET),"yyyyMMdd HH\:mm\:ss")

c. event.deviceCustomDate2=__safeToDate(event.deviceCustomString1,"yyyyMMdd HH\:mm\:ss")

Attempt 3: - - ----- Partially OK but unsuccessful while converting to Timestamp

Now, I want to make sure the tokens are converted to string first, so

event.deviceCustomString1=__concatenate(ED," ",ET) – Successfully mapped as "2016-09-06 17:25:57"

However the below doesn’t work again,

event.endTime=__createOptionalTimeStampFromString(event.deviceCustomString1,"yyyyMMdd HH\:mm\:ss")

Please let me know, if I'm I missing something here..

[Samour]

I hink you may need to escape the T

[Samour]

I hink you may need to escape the T

[skrc851]

Hi..refer to my attempt 2 & 3, 'T' is nowhere included.

[klr01]

Hi Saravanakumar,

I figured out how to properly map the Windows timestamp found in event logs in this thread:

Hope that thread helps!