timestamp not being handled properly

a212830 — Mon, 28 Sep 2020 12:57:04 GMT

Hi,

I'm having issues getting Splunk to properly recognize the date on some logfiles. The input is pretty simple:

10-Dec-12 12:28:36 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=37.00000000 DURATION=303
10-Dec-12 12:33:39 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=52.00000000 DURATION=300
10-Dec-12 12:38:39 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=55.00000000 DURATION=299
10-Dec-12 12:43:38 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=38.00000000 DURATION=302

My props file has the following:

[snmpinfo]
MAX_TIMESTAMP_LOOKAHEAD = 35
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%y %H:%M:%S
TIME_PREFIX = ^

The time is getting picked up properly, but the date is coming in as 12/12/10. What am I doing wrong? I looked at the strptime, and it looks correct to me. This data is coming in from a heavy-forwarder to an indexer.

Re: timestamp not being handled properly

sowings — Tue, 11 Dec 2012 21:23:25 GMT

If the data is being picked up from a heavy forwarder (read: event aware) it's doing the parsing of time stamps; you'll want to ship the same bit of configuration over to the heavy as well.

Re: timestamp not being handled properly

a212830 — Tue, 11 Dec 2012 21:29:25 GMT

That's where I have the props.conf - on the forwarder. Should I put it on the indexer as well? If yes, why?

topic Re: timestamp not being handled properly in Getting Data In

timestamp not being handled properly

Re: timestamp not being handled properly

Re: timestamp not being handled properly