Commodore Commodore
Commodore
948 views

FlexConnector Timestamp Conversion - SharePoint ULS Log

Jump to solution

I have a need to process data from SharePoint ULS logs using a custom FlexConnector. I am having trouble converting the timestamp in these logs properly.

An example of a timestamp in the ULS log is:      03/29/2016 18:34:02.68

My sdkfilereader.properties file looks like:

token[2].name=ULS_DateTime

token[2].type=String

event.deviceReceiptTime=__createOptionalTimeStampFromString(ULS_DateTime,"MM/DD/yyyy HH:mm:ss.SSS")

The ESM's deviceReceiptTime field is returning a timestamp of: 29 Jan 2016 18:34:02 GMT

Does anyone have any idea why the month would not be converting properly? The rest of the timestamp converts fine. Any suggestions would be much appreciated.

Thank you!

Labels (3)
0 Likes
1 Solution

Accepted Solutions
Commodore Commodore
Commodore

I found a solution. Because there is no time zone specified in the timestamp provided in the ULS logs, the FlexConnector kept parsing the time 1 hour behind.

I updated the .sdkfilereader.properties to:

event.deviceReceiptTime=__createOptionalTimeStampFromString(__concatenate(ULS_DateTime,"Z"),"MM/dd/yyyy HH:mm:ss.SSSX")

where I concatenated a "Z" to represent UTC/GMT to force the timestamp to be parsed in the proper time zone.

View solution in original post

0 Likes
7 Replies
Commodore Commodore
Commodore

I was able to get a little closer. I updated the .sdkfilereader.properties to:

event.deviceReceiptTime=__createOptionalTimeStampFromString(ULS_DateTime,"MM/dd/yyyy HH:mm:ss.SSS")

I did not realize that "DD" represented the day in the year not the day of the month. Now I am getting: 29 Mar 2016 17:34:02 GMT

So now, I'm only off by 1 hour. Any suggestions are appreciated.

Thanks!

0 Likes
Commodore Commodore
Commodore

I found a solution. Because there is no time zone specified in the timestamp provided in the ULS logs, the FlexConnector kept parsing the time 1 hour behind.

I updated the .sdkfilereader.properties to:

event.deviceReceiptTime=__createOptionalTimeStampFromString(__concatenate(ULS_DateTime,"Z"),"MM/dd/yyyy HH:mm:ss.SSSX")

where I concatenated a "Z" to represent UTC/GMT to force the timestamp to be parsed in the proper time zone.

View solution in original post

0 Likes
Captain
Captain

Hi , I've got something to ask on a flex parser I've been working today, kindly let me know what am I missing..

My Timestamp: 2016-09-06T17:25:57 ----- I need to map this to endTime

Attempt 1:

token[0].name=ET ,     token[0].type=TimeStamp ,     token[0].format=yyyyMMddTHH\:mm\:ss 
event.endTime=ET---------------- Unsuccessful

Attempt 2:

token[0].name=ED , token[0].type=String

token[1].name=ETtoken[1].type=String
All the below were not returning any values – I mean the fields are just empty-no values seen and no errors seen as well - ---------------- Unsuccessful

a. event.deviceReceiptTime=__createOptionalTimeStampFromString(__concatenate(ED," ",ET),"yyyyMMdd HH\:mm\:ss")


b. event.deviceCustomDate1=__createOptionalTimeStampFromString(__concatenate(ED," ",ET),"yyyyMMdd HH\:mm\:ss")


c. event.deviceCustomDate2=__safeToDate(event.deviceCustomString1,"yyyyMMdd HH\:mm\:ss")

Attempt 3: - - ----- Partially OK but unsuccessful while converting to Timestamp

Now, I want to make sure the tokens are converted to string first, so

event.deviceCustomString1=__concatenate(ED," ",ET) – Successfully mapped as "2016-09-06 17:25:57"

However the below doesn’t work again,

event.endTime=__createOptionalTimeStampFromString(event.deviceCustomString1,"yyyyMMdd HH\:mm\:ss")

Please let me know, if I'm I missing something here..

0 Likes
Vice Admiral
Vice Admiral

I hink you may need to escape the T

0 Likes
Vice Admiral
Vice Admiral

I hink you may need to escape the T

0 Likes
Captain
Captain

Hi..refer to my attempt 2 & 3, 'T' is nowhere included.

0 Likes
Commodore Commodore
Commodore

Hi Saravanakumar,

I figured out how to properly map the Windows timestamp found in event logs in this thread:

Hope that thread helps!

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.