topic Re: how to format date without year in the time stamp in Getting Data In

how to format date without year in the time stamp

Kozanic — Tue, 30 Sep 2014 00:07:24 GMT

I have a file that I'm trying to get the date right on - but am not having much success, and haven't been able to find a solution as yet.

Time stamp format is as below:
09/23 16:30:01.55

This is at the start of the event line with other information following.

I have tried using: TIME_FORMAT=%d/%m %H:%M:%S.%2N

however, this gives me: 9/20/01 6:24:41.550 AM

2 things I would like to try and achieve are:

Kozanic — Tue, 30 Sep 2014 02:02:45 GMT

Minor edit:
TIME_FORMAT=%m/%d %H:%M:%S.%3N

sk314 — Tue, 30 Sep 2014 02:19:39 GMT

Kozanic — Tue, 30 Sep 2014 04:32:50 GMT

Thanks sk314, I hadn't, but I have tried and it doesn't seem to be working for me - not sure if I'm doing it wrong somehow.

Will continue to play and see what I can work out.

markthompson — Tue, 30 Sep 2014 10:06:32 GMT

You could try using the convert command.

convert timeformat=%d/%m ctime(Time)

This should work I think, I've used it in a graph to change the time stamp, but not the date, I think it should still apply.

Kozanic — Tue, 30 Sep 2014 22:57:52 GMT

Thanks Mark,

Am I able to use convert at index time?

I have tried your suggestion, but does seem to make any different to the Timestamp being generated.

markthompson — Wed, 01 Oct 2014 07:47:13 GMT

Hi Kozanic,
Do you mean at the time that it indexes the file? If so, I don't think you can, but it can be used in search queries,
Otherwise I think you could use this solution; http://answers.splunk.com/answers/525/how-can-i-change-the-time-format-in-splunk-web.html

Hope this helps 🙂