topic Re: Time format is not working as per props.conf file in Getting Data In

Time format is not working as per props.conf file

ajitshukla61116 — Wed, 30 Sep 2020 00:55:13 GMT

I want to ingest data at current time ,for that we are using props.conf file ,the configuration for which is

props.conf
DATETIME_CONFIG =CURRENT
TIME_FORMAT =%Y-%m-%d %H:%M:%S

I am getting current time properly but TIME FORMAT is not working.

I don't know what is the issue ,please help me to resolve this issue.

Re: Time format is not working as per props.conf file

richgalloway — Sat, 15 Jun 2019 12:11:53 GMT

TIME_FORMAT applies to parsing timestamp strings in events. You are not parsing timestamps.

If you want to change how timestamps are presented to users, try the strftime function. For example, ... | eval time=strftime(_time, "%Y-%m-%d %H:%M:%S") | table time ....

Re: Time format is not working as per props.conf file

VatsalJagani — Sun, 16 Jun 2019 15:59:03 GMT

Hello @ajitshukla,
Timestamp in Splunk stored in epoch format (interger) not in any string format so here TIME_FORMAT will not be used as you have added DATETIME_CONFIG to CURRENT.

Re: Time format is not working as per props.conf file

woodcock — Sun, 16 Jun 2019 22:42:58 GMT

The TIME_FORMAT setting is for when you parse event characters to pull out timestamps, which you are NOT doing so it is not used.

There is only 1 way to change how timestamps appear generally, that is to use a different localization which is part of your URL. Most of the time this is en-US but try en-GB for example, to see how it changes. In any case, you have FULL CONTROL of this on a search-by-search basis. Just add this to the bottom/middle of any search:

... | fieldformat _time=strftime(_time, "%Y-%m-%d %H:%M:%S")