topic french timestamp not understood in Getting Data In

french timestamp not understood

pfoucher — Tue, 18 Nov 2014 14:33:46 GMT

Hello,
I have a log where the timestamp is written with a abbreviated name for the month. My problem is that the abreviation is a french one and splunk does not understand it.
Example : (déc for december)
01-déc-10|15:28:16.0| xxxx
01-déc-10|15:59:38.3| yyy
As a consequence, all the lines are appended into a single event.
I tried to modify the file datetime.xml, but it didn't work.
Can someone help me ?
Thank you

Re: french timestamp not understood

lmyrefelt — Tue, 18 Nov 2014 15:24:46 GMT

The following should work;

in props.conf

["your-sourcetype"]
DATETIME_CONFIG = ("path")/etc/apps/"app-name"/"path"/datetime.xml

inside datetime.xml, under lithmonth / _litmonth

dec|déc

... Well to be honest .. i have not tried using charachters like åæøø yet .. but ...

restart of course

here comes some additional good information;

http://blogs.splunk.com/2014/04/23/its-that-time-again/
http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

Re: french timestamp not understood

pfoucher — Thu, 20 Nov 2014 16:54:56 GMT

I tried to modify the datetime.xml file as with your example, but it didn't work. Splunk does not recognize the "é" character, and displays \xE9 instead. This character belongs to UTF-8, it should be recognized, isn't it ?

Re: french timestamp not understood

lmyrefelt — Fri, 21 Nov 2014 14:28:32 GMT

Might be something for an enchantment request? Or the support to help u with ?

Either way .. it should be "best practies" to keep the goods in english 😉 and no puny åæøèé whatever .. makes live easier

Re: french timestamp not understood

gfuente — Fri, 21 Nov 2014 14:52:35 GMT

Hello

This is officially not supported:

Note: Splunk Enterprise does not currently recognize non-English month names in timestamps. If you have an app that writes non-English month names to log files, reconfigure the app to use numerical months, if possible.

From: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configuretimestamprecognition

Regards

Re: french timestamp not understood

raz_gp — Fri, 22 Dec 2023 09:14:32 GMT

having the same issue for weekdays and month dates.
Is this something that will happen or we need to fix it ourselves creatively ?

mer. 13 déc. 2023 23:31:20 CET file_hash=96def1...
mar. 19 déc. 2023 22:06:55 CET user=x ...
mar. 19 déc. 2023 09:16:13 CET user=y ...