How do I add the year dynamically to an event with a timestamp that doesn't have one?

JackNobrega — Fri, 01 May 2015 12:48:43 GMT

I have a timestamp that needs to be fixed. It doesn't have a year in the timestamp. Example Apr 30 16:40:08. How do I dynamically fix this so Splunk can index it correctly?

Re: How do I add the year dynamically to an event with a timestamp that doesn't have one?

stephane_cyrill — Fri, 01 May 2015 13:42:56 GMT

Hi this will help.

docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition

To configure how Splunk Enterprise recognizes timestamps, edit
props.conf . There are a number of attributes that pertain to
timestamps. In particular, you can determine how Splunk Enterprise
recognizes a timestamp by using the TIME_FORMAT attribute to specify
a strptime() format for the timestamp. You can also set other
attributes pertaining to timestamps; for example, to specify where a
timestamp is located in an event, what time zone to use, or how to
deal with timestamps of varying currency.

topic Re: How do I add the year dynamically to an event with a timestamp that doesn't have one? in Getting Data In

How do I add the year dynamically to an event with a timestamp that doesn't have one?

Re: How do I add the year dynamically to an event with a timestamp that doesn't have one?