https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152739#M31088 <P>Worked like a charm, great site also. Thanks</P> Mon, 17 Feb 2014 21:08:48 GMT timgtallongs 2014-02-17T21:08:48Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152737#M31086 <P>Hi all</P> <P>I have the following log:</P> <P>09-feb-14 10:54:06.501 <INFO> [w3wp.1320] {VproofApi}proofApi.GetOpenSessionscalled. </INFO></P> <P>Splunk parses this date as 2009-02-14 (year-month-day)</P> <P>Because i want the 09 as my day i tried using following time_format:</P> <P>%d-%m-%Y %H:%M:%S</P> <P>This gives an error</P> <P>Thanks in advance </P> Mon, 17 Feb 2014 09:16:09 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152737#M31086 timgtallongs 2014-02-17T09:16:09Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152738#M31087 <P>Yes, <CODE>%m</CODE> is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is <CODE>%b</CODE>. Also, you might want to change the <CODE>%Y</CODE> to <CODE>%y</CODE>, since you only represent the year with two digits. Then you can add the milliseconds as well.</P> <PRE><CODE>TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N </CODE></PRE> <P><A href="http://www.strftime.net">http://www.strftime.net</A></P> <P>/K</P> Mon, 17 Feb 2014 10:43:13 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152738#M31087 kristian_kolb 2014-02-17T10:43:13Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152739#M31088 <P>Worked like a charm, great site also. Thanks</P> Mon, 17 Feb 2014 21:08:48 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-parsed-incorrectly/m-p/152739#M31088 timgtallongs 2014-02-17T21:08:48Z