topic Re: time format in log4j in Getting Data In

time format in log4j

gcusello — Fri, 04 Aug 2017 12:13:18 GMT

Hi at all,
I have a strange question, strange because it should be easy but it doesn't run!
I have log4j logs with a timesamp

2017-07-26 00:05:21 DEBUG

that is wrongly read by Splunk as

7/26/17 12:05:21 AM

I tried with and without TomeZone.

How can I fix this problem? what I forgot (Holidays are coming 😉 )?

Bye.
Giuseppe

Re: time format in log4j

richgalloway — Fri, 04 Aug 2017 12:49:59 GMT

What is the expected interpretation of that log4j timestamp? Splunk's interpretation looks right to me.

Re: time format in log4j

gcusello — Fri, 04 Aug 2017 13:33:54 GMT

Probably I have an interpretation problem from the italian way to show hours:
12 AM is followed by 1 AM, 2 AM and so on, correct?
In Italy we have 0 AM, 1 AM, 2AM and so on!
Bye.
Giuseppe

Re: time format in log4j

niketn — Fri, 04 Aug 2017 14:22:24 GMT

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

Re: time format in log4j

niketn — Fri, 04 Aug 2017 14:22:24 GMT

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

Re: time format in log4j

gcusello — Fri, 04 Aug 2017 14:54:36 GMT

Yes!
every day I learn!
Thank you.
Bye.
Giuseppe

Re: time format in log4j

niketn — Fri, 04 Aug 2017 16:43:12 GMT

Cheers! Have a nice weekend 🙂