<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Day Of Month Field Without A Leading Zero in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91047#M18925</link>
    <description>&lt;P&gt;I have a log which contains entries like the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;(3/07/12 13:13:09) 8856: &amp;lt; RingBufferModule::initialize()
(3/07/12 13:13:09) 8857: Finished init of: 'RingBufferLoggingAppender'
(3/07/12 13:13:09) 8858: Initializing 'AudioPathController'
(3/07/12 13:13:09) 8859: Unable to find value for key: 'SrxSupervisorAudioEnable'
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The date component is day/month/year. So in the above example, we have the 3rd July 2012. As you can see, the day of month (i.e. 3 in the above example) does not contain a leading zero. According to strptime, %d represents 01-31 and there seems to be nothing for 1-31. I've tried the following in props.conf but to no avail: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_FORMAT=%d%m/%g  %H:%M:%S
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Any suggestions to this would be appreciated.&lt;/P&gt;</description>
    <pubDate>Thu, 05 Jul 2012 03:58:06 GMT</pubDate>
    <dc:creator>sajbutler</dc:creator>
    <dc:date>2012-07-05T03:58:06Z</dc:date>
    <item>
      <title>Day Of Month Field Without A Leading Zero</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91047#M18925</link>
      <description>&lt;P&gt;I have a log which contains entries like the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;(3/07/12 13:13:09) 8856: &amp;lt; RingBufferModule::initialize()
(3/07/12 13:13:09) 8857: Finished init of: 'RingBufferLoggingAppender'
(3/07/12 13:13:09) 8858: Initializing 'AudioPathController'
(3/07/12 13:13:09) 8859: Unable to find value for key: 'SrxSupervisorAudioEnable'
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The date component is day/month/year. So in the above example, we have the 3rd July 2012. As you can see, the day of month (i.e. 3 in the above example) does not contain a leading zero. According to strptime, %d represents 01-31 and there seems to be nothing for 1-31. I've tried the following in props.conf but to no avail: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_FORMAT=%d%m/%g  %H:%M:%S
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Any suggestions to this would be appreciated.&lt;/P&gt;</description>
      <pubDate>Thu, 05 Jul 2012 03:58:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91047#M18925</guid>
      <dc:creator>sajbutler</dc:creator>
      <dc:date>2012-07-05T03:58:06Z</dc:date>
    </item>
    <item>
      <title>Re: Day Of Month Field Without A Leading Zero</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91048#M18926</link>
      <description>&lt;P&gt;There is a strange double space in your timeformat.&lt;/P&gt;

&lt;P&gt;Also, you could try to add the characters around.&lt;BR /&gt;
&lt;PRE&gt; &lt;BR /&gt;
TIME_FORMAT=(%d/%m/%g %H:%M:%S)&lt;BR /&gt;
&lt;/PRE&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 05 Jul 2012 05:00:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91048#M18926</guid>
      <dc:creator>yannK</dc:creator>
      <dc:date>2012-07-05T05:00:48Z</dc:date>
    </item>
    <item>
      <title>Re: Day Of Month Field Without A Leading Zero</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91049#M18927</link>
      <description>&lt;P&gt;Thanks for the suggestions yannK. &lt;/P&gt;

&lt;P&gt;I've removed the double space from the TIME_FORMAT and also tried enclosing in brackets but still no good.&lt;/P&gt;</description>
      <pubDate>Thu, 05 Jul 2012 06:24:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91049#M18927</guid>
      <dc:creator>sajbutler</dc:creator>
      <dc:date>2012-07-05T06:24:05Z</dc:date>
    </item>
    <item>
      <title>Re: Day Of Month Field Without A Leading Zero</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91050#M18928</link>
      <description>&lt;P&gt;You are missing a slash after the %d and before %m in your first post.&lt;BR /&gt;
I always use %Y for four-digit year and %y for two-digit year.&lt;BR /&gt;
%d is always zero-padded (03/07/12)&lt;BR /&gt;
%e is space-padded ( 3/07/12)&lt;BR /&gt;
I would try:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;%e/%m/%y %H:%M:%S
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;%e/%m/%y %T 
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 05 Jul 2012 16:05:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91050#M18928</guid>
      <dc:creator>itinney</dc:creator>
      <dc:date>2012-07-05T16:05:34Z</dc:date>
    </item>
    <item>
      <title>Re: Day Of Month Field Without A Leading Zero</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91051#M18929</link>
      <description>&lt;P&gt;Missing slash. Ouch. The %e space pads and works fine. I can confirm that the following following config in props.conf works:&lt;BR /&gt;
TIME_FORMAT=%e/%m/%g %H:%M:%S&lt;BR /&gt;
TIME_PREFIX=[(]&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 12:02:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Day-Of-Month-Field-Without-A-Leading-Zero/m-p/91051#M18929</guid>
      <dc:creator>sajbutler</dc:creator>
      <dc:date>2020-09-28T12:02:00Z</dc:date>
    </item>
  </channel>
</rss>

