topic Re: How to parse the date_time and event_time fields from my raw data in PSV format? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-date-time-and-event-time-fields-from-my-raw/m-p/152092#M30959 <P>You need to tell Splunk how to interpret the timestamp in each event as documented here:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps</A></P> <P>Just by looking at your event, I have no idea how to interpret your timestamps so I assume Splunk is treating them as <CODE>epoch</CODE> which is giving a time way in the past.</P> Tue, 09 Jun 2015 16:40:23 GMT woodcock 2015-06-09T16:40:23Z How to parse the date_time and event_time fields from my raw data in PSV format? https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-date-time-and-event-time-fields-from-my-raw/m-p/152091#M30958 <P>hi,</P> <P>i have some mainframe logs coming into splunk which is in PSV (pipe separated value) format. have managed to parse all of the data successfully, but the <CODE>date_time</CODE> and <CODE>Event_time</CODE> fields are showing dates as 31 dec, 1969 and 1970, but in the log file, it's dated april to june of 2015. </P> <P>sample log:</P> <PRE><CODE>IN|15080|830828|V014MSNY|B014MU01|CAL0Q14|DPNT1|PSABTSR1|||0000000|DDTD34|FAIL|10|012||||x980|USER| </CODE></PRE> Tue, 09 Jun 2015 15:56:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-date-time-and-event-time-fields-from-my-raw/m-p/152091#M30958 shivarpith 2015-06-09T15:56:43Z Re: How to parse the date_time and event_time fields from my raw data in PSV format? https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-date-time-and-event-time-fields-from-my-raw/m-p/152092#M30959 <P>You need to tell Splunk how to interpret the timestamp in each event as documented here:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps</A></P> <P>Just by looking at your event, I have no idea how to interpret your timestamps so I assume Splunk is treating them as <CODE>epoch</CODE> which is giving a time way in the past.</P> Tue, 09 Jun 2015 16:40:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-date-time-and-event-time-fields-from-my-raw/m-p/152092#M30959 woodcock 2015-06-09T16:40:23Z