topic Re: Timestamp parsing with separate Date and Time fields in Getting Data In

Timestamp parsing with separate Date and Time fields

tread_splunk — Tue, 29 Sep 2020 08:30:11 GMT

Hi there,

My event data has the following extract about 100chars in from the start of the event...

&ltdate_value&gt2015-08-30T00:00:00&lt/date_value&gt&lttime_value&gt23:58:52&lt/time_value&gt&ltagency&gtMCP&lt/agency&gt

I'm trying to get Splunk to construct the event timestamp value as 2015-08-30 23:58:52.

I've tried various forms of the following in PROPS.CONF...

TIME_FORMAT = YYYY-MM-DDT00:00:00&lt/date_value&gt<time_value>&lttime_value&gtHH:MM:SS

TIME_PREFIX = &ltdate_value&gt

Suggestions greatly appreciated.
Tony.

richgalloway — Fri, 22 Jan 2016 13:17:12 GMT

The TIME_FORMAT attribute must use strptime() metacharacters. Try this:

MAX_TIMESTAMP_LOOKAHEAD = 200
TIME_PREFIX = <date_value>
TIME_FORMAT = %Y-%m-%DT00:00:00</date_value><time_value>%H:%M:%S

tread_splunk — Mon, 25 Jan 2016 16:28:51 GMT

Thanks @richgalloway. Spot on.

antlefebvre — Tue, 17 May 2016 16:28:14 GMT

I changed the %D to %d to make this work. Thanks @richgalloway