topic Re: splunk extract incorrect time in Getting Data In

splunk extract incorrect time

perlish — Tue, 29 Sep 2020 14:14:03 GMT

Hi,everyone.

My raw log is like this:
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.110 port:60046 count:6
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.91 port:38026 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:118.43.104.16 port:33967 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:119.1.109.17 port:43973 count:3

And the count of raw log is 409767.
All of the time is 2017/05/22 01:00:01 in raw log.
But splunk extract timestamp is 2017/05/22 01:00:01 2017/05/22 01:00:02 2017/05/22 01:00:03 2017/05/22 01:00:04 2017/05/22 01:00:05
I use this search comand "sourcetype=test |stats count by _time",and got this result.
_time count
2017/05/22 01:00:01 100000
2017/05/22 01:00:02 100000
2017/05/22 01:00:03 100000
2017/05/22 01:00:04 100000
2017/05/22 01:00:05 9767

I have set TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf,but doesn`t work.
I also use this "sourcetype=test | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") "
The timestamp return aN/NaN/NaN NaN:NaN:NaN.000
Anyone know how to solve this issue?
Thanks.

Re: splunk extract incorrect time

koshyk — Tue, 23 May 2017 14:55:09 GMT

The time format logic should Work. Just tested as below

|makeresults | eval _time="2017-05-22 01:00:01" | eval myEpoch=strptime(_time,"%Y-%m-%d %H:%M:%S")| eval reConvertTime=strftime(myEpoch,"%FT%T")

In your props Try putting and restarting Splunk

TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD=32

Re: splunk extract incorrect time

somesoni2 — Tue, 23 May 2017 14:57:01 GMT

See this

https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond.html

Re: splunk extract incorrect time

akocak — Tue, 23 May 2017 17:10:16 GMT

Props you have defined, is it under search or your custom app?

Re: splunk extract incorrect time

perlish — Wed, 24 May 2017 01:59:14 GMT

Solved. Thank you so much.

Re: splunk extract incorrect time

perlish — Wed, 24 May 2017 02:00:03 GMT

Still doesn`t work, it should be splunk limit.
https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond.html