https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422437#M74228 <P>Ah, I misspoke...subseconds are almost always "000" when they are there, but sometimes they aren't there at all.</P> Tue, 29 May 2018 14:01:32 GMT gregbo 2018-05-29T14:01:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422428#M74219 <P>I'm trying to use splunk train to learn my timestamps so I can put them in a datetime.xml file, and it won't even try. My timestamps look like: 20180529132292003-0700 and 20180529132292-0700</P> <H2>All it says is:</H2> <H2>Interactively learning date formats.</H2> <P>Skipping unpromissing line 1.<BR /> Skipping unpromissing line 2.</P> Tue, 29 May 2018 11:36:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422428#M74219 gregbo 2018-05-29T11:36:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422429#M74220 <P>Why trying to train and not just specify the format explicitely with TIME_FORMAT?</P> <P>As also discussed in your other question here: <A href="https://answers.splunk.com/answers/660301/why-arent-timestamps-being-recognized-consistently.html">https://answers.splunk.com/answers/660301/why-arent-timestamps-being-recognized-consistently.html</A></P> <P>PS: 20180529132292003-0700 is a strange timestamp. Based on your previous explanation, this has 92 as the seconds, which cannot be correct...</P> Tue, 29 May 2018 12:31:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422429#M74220 FrankVl 2018-05-29T12:31:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422430#M74221 <P>My guess would be that, because of the lack of any seperators, it doesn't see a way to actually extract anything meaningful out of it. For a human, the timestamp is rather easy to read, but not for software. I'd try to either change the timestamps to contain seperators, or, just do this manually, by using either TIME_FORMAT or building a datetime.xml yourself.</P> <P>However, I tried to build a timestamp extraction for this - and the format is pretty weird.</P> <P>Using <CODE>20180529132292003-0700</CODE>, I'd split it like <CODE>2018-05-29 13:22</CODE>, but after that - what is 92003 supposed to mean? Is it 0.92003 minutes? Or is this just a bad example?</P> <P>You see, if a human has difficulties to get a proper timestamp out of it... how should Splunk do this? <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 May 2018 12:40:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422430#M74221 xpac 2018-05-29T12:40:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422431#M74222 <P>That was a typo. I changed it and it still didn't work. I'm trying to train because the data has timestamps with two different formats, and multiple posts made it sound like using datetime.xml would be "easy". I can't change the format of the timestamp in the data, it's an international standard for this type of data</P> Tue, 29 May 2018 12:47:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422431#M74222 gregbo 2018-05-29T12:47:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422432#M74223 <P>I can't change the format of the timestamp, it's an international standard for the data I'm trying to pull in.</P> Tue, 29 May 2018 12:48:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422432#M74223 gregbo 2018-05-29T12:48:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422433#M74224 <P>No options to collect those 2 different formats separately?</P> Tue, 29 May 2018 12:56:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422433#M74224 FrankVl 2018-05-29T12:56:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422434#M74225 <P>And the same data stream sometimes has subseconds, and sometimes has not? (like the <CODE>003</CODE> part in your example above)</P> Tue, 29 May 2018 12:59:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422434#M74225 xpac 2018-05-29T12:59:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422435#M74226 <P>They usually have subseconds of "000". </P> Tue, 29 May 2018 13:10:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422435#M74226 gregbo 2018-05-29T13:10:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422436#M74227 <P>Okay, if subseconds are always present, you could simply use <CODE>TIME_FORMAT = %Y%m%d%H%M%S%3N%z</CODE>. Splunk actually recognizes your timestamp without any additional training, but for some reason ignores the timezone information...</P> Tue, 29 May 2018 13:54:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422436#M74227 xpac 2018-05-29T13:54:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422437#M74228 <P>Ah, I misspoke...subseconds are almost always "000" when they are there, but sometimes they aren't there at all.</P> Tue, 29 May 2018 14:01:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422437#M74228 gregbo 2018-05-29T14:01:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422438#M74229 <P>Mhh, that's pretty shitty... any chance to get that fixed with the log source? Inconsistent timestamps might actually force you to go back to datetime.xml...</P> Tue, 29 May 2018 14:10:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422438#M74229 xpac 2018-05-29T14:10:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422439#M74230 <P>Next to no chance...I'll probably have to try datetime.xml, which hasn't worked at all the last couple times I tried it...oh well</P> Tue, 29 May 2018 15:00:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-train-Splunk-to-learn-my-timestamps/m-p/422439#M74230 gregbo 2018-05-29T15:00:43Z