https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11302#M554 <P>I don't know of a way to have it read that. Splunk uses strptime, plus a few additions (like %Z, %3N, and I <EM>think</EM> it might be able to pick up hexadecimal epoch time) but I am not aware of a way to offset dates or times at index time.</P> Tue, 13 Apr 2010 21:03:42 GMT gkanapathy 2010-04-13T21:03:42Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11301#M553 <P>Log entries have timestamps with Taiwan years. Taiwan year = current year-1911, so this year is 99. By default Splunk sees the time as the year 1999 and shows old data</P> <PRE><CODE>990413 10:14:25 = April 13, 2010 10:14:25 </CODE></PRE> <P>Is this something I can use datetime.xml for? Maybe an offset?</P> Tue, 13 Apr 2010 14:24:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11301#M553 dskillman 2010-04-13T14:24:35Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11302#M554 <P>I don't know of a way to have it read that. Splunk uses strptime, plus a few additions (like %Z, %3N, and I <EM>think</EM> it might be able to pick up hexadecimal epoch time) but I am not aware of a way to offset dates or times at index time.</P> Tue, 13 Apr 2010 21:03:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11302#M554 gkanapathy 2010-04-13T21:03:42Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11303#M555 <P>It can definitely pick up hex epoch time.</P> Wed, 14 Apr 2010 10:23:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11303#M555 dskillman 2010-04-14T10:23:23Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11304#M556 <P>Support for offsets (or taiwanese years) would be an enhancement request. For this case you might be able to get away with a strptime that ignores the year, with a TIME_PREFIX that skips past it (be sure your regex doesn't fail next year when they go to 100). We <EM>should</EM> be able to default to the current year. Untested.<BR /> 4 digit years are highly recommended. Sounds like Taiwan will go through this learning experience next year.</P> Sat, 17 Apr 2010 07:14:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-read-in-a-log-entry-with-uncommon-time-formats/m-p/11304#M556 jrodman 2010-04-17T07:14:24Z