topic Re: Timestamp index do not consider hours in Getting Data In

Timestamp index do not consider hours

nolivieri — Thu, 21 Jun 2012 09:45:31 GMT

Hi all,

I've a csv with a timestamp like this:

2012-05-14 08

which is, of course, in the form:

%Y-%m-%d %H

Unfortunately, when trying to index it, it only takes the date:

14/05/12 00.00.00,000

How can I make it aware of the hour? Obviously it would have minutes and seconds equals to "00"...
Thanks a lot, bye!!

Edit: here is the screenshot:

Re: Timestamp index do not consider hours

Ayn — Thu, 21 Jun 2012 10:01:10 GMT

You need to tell Splunk how to parse the timestamp by providing the appropriate format in the TIME_FORMAT configuration directive in props.conf.

[my_sourcetype]
TIME_FORMAT = %Y-%m-%d %H

This will apply to events that get indexed after you've made the changes and restarted Splunk (so events that already exist in the index will not be affected).

More information on configuring timestamp recognition here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition

Re: Timestamp index do not consider hours

nolivieri — Thu, 21 Jun 2012 10:04:26 GMT

I've already done it by setting it in the web interface while importing the new datas...I'll try to attach a screenshot of what I already have...