topic Re: Splunk won't correctly recognize timestamp in Getting Data In

Splunk won't correctly recognize timestamp

pero1234 — Tue, 17 Jan 2012 16:13:05 GMT

Why splunk won't correctly recognize this timestamp?

120129092233

my props.conf

TIME_FORMAT=%Y%m%d%H%M%S
TIME_PREFIX=^

example of source log:

120129092231;field1 field2  field3
120129092232;field1 field2  field3
120129092233;field1 field2  field3

Re: Splunk won't correctly recognize timestamp

hedgehog — Tue, 17 Jan 2012 16:33:15 GMT

Your time_Prefix stanza looks correct but I dont think you need the prefix. Not sure if the docs will shed some light but you can fine them here: http://docs.splunk.com/Documentation/Splunk/latest/Data/
ConfigureTimestampRecognition

Re: Splunk won't correctly recognize timestamp

imrago — Tue, 17 Jan 2012 16:55:20 GMT

try:

TIME_FORMAT=%y%m%d%H%M%S
TIME_PREFIX=^

Re: Splunk won't correctly recognize timestamp

pero1234 — Tue, 17 Jan 2012 17:29:43 GMT

Works! Yes, y% is for year without century like in my log.
Splunk rocks!!