topic Re: Correct Timestamp in Getting Data In

Correct Timestamp

matthewcanty — Thu, 07 Jun 2012 09:07:20 GMT

Problem. Just got back into office and found that logs for the 1st - 6th June, went to 6th Jan, 6th Feb, 6th Mar and so on. Meaning my datetime - dd-MM-yy hh:mm:ss,ffff - is being misrepresented by the american datetime format - swapping day for month.

What is the correct way to format the date? And is there a way to fix where the raw data is being processed not as I intended.

Re: Correct Timestamp

kristian_kolb — Mon, 28 Sep 2020 11:54:52 GMT

Unfortunately there is no 'correct' way to format dates, and there are several popular variants, such as YYYY-mm-dd HH:MM:SS or mm/dd/YY. However, Splunk recognizes most of them quite well, but naturally there are situations where a date can be ambiguous e.g. 05/03/11.

In those cases, it might be neccessary to instruct Splunk how to parse these correctly. This is done in props.conf on the server where the parsing phase takes place. Normally this is on the indexer, but if your files are coming through a full/heavy forwarder you'd do the configuration there instead.

in props.conf

[your_sourcetype]
TIME_FORMAT = %m/%d/%Y

or whatever your actual time format is.

Unfortunately you cannot change what has already been indexed...

Check out the docs for props.conf;
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf and for information on which config goes where in general;
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Hope this helps,

Kristian

Re: Correct Timestamp

matthewcanty — Thu, 07 Jun 2012 12:45:16 GMT

Thanks for the info. I have changed the props.conf according to http://splunk-base.splunk.com/answers/45237/choosing-the-correct-timestamp also I have modified the date-time format to yyyy/MM/dd etc.