topic Re: Why is my timestamp not being recognized... in Getting Data In

Why is my timestamp not being recognized...

a212830 — Wed, 03 May 2017 15:17:03 GMT

Hi,

I have the following data coming in:

10009 SYSTEM 03/05/17 11:12:44 Info Message Partner MQCACTUSOUT, Session 611 - Message sent
    Sequence number : 242034
    UUMID           : OCHASUS33XXX9002556093123JY    
    Suffix          : 1705031356750
 - lrtAZ842

The problem is, instead of interpresting the date as May 3rd, it's being interpreted as March 5th. My props has the following, which looks correct to me.

[swift_alarmsmsgs]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
ANNOTATE_PUNCT=false
KV_MODE=auto
LINE_BREAKER = ([\r\n]+)\d{5}
TIME_FORMAT = %d/%m/%y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=50

Re: Why is my timestamp not being recognized...

gcusello — Wed, 03 May 2017 15:37:47 GMT

Hi a212830,
for me the best approach to a timestamp problem is to download an example of your log in a file and try to ingest it using the Splunk web gui.
In this way you can immediately check your configurations and verify problems.

In your specific situation, the problem could be in MAX_TIMESTAMP_LOOKAHEAD=18 and TIME_PREFIX=\d+\s\w+\s

Bye.
Giuseppe

Re: Why is my timestamp not being recognized...

DalJeanis — Wed, 03 May 2017 16:23:46 GMT

Upvote for likely correct TIME_PREFIX to fix the OP's issue.

Re: Why is my timestamp not being recognized...

sloshburch — Mon, 08 May 2017 13:03:13 GMT

Agreed. I was gonna say TIME_PREFIX as well.