topic Re: set year to timestamp in Getting Data In

set year to timestamp

sarit_s — Mon, 20 Apr 2020 10:23:10 GMT

Hello

I'm getting logs from my customer and the timestamp there is day and month without year.
that case causes splunk to index the events with future dates
example:

12/31/20 11:59:59.000 PM Dec 31 23:59:59 csm kerne

how can i modify the date before indexing so i will see the correct timestamp ?

thanks

Re: set year to timestamp

PavelP — Mon, 20 Apr 2020 10:43:06 GMT

Hello @sarit_s ,

actually 12/31/20 looks like a date (31 Dec 2020), just wrong one. I'd try to solve it on the log source side if possible.

Can you check the date on the source machine?
Is the date 12/31/20 completely wrong or the year only?
Have you patched your splunk against the timestamp issue?: https://docs.splunk.com/Documentation/Splunk/8.0.3/ReleaseNotes/FixDatetimexml2020
Can you show your current TIME_FORMAT?

Re: set year to timestamp

sarit_s — Mon, 20 Apr 2020 11:09:26 GMT

Hey
thanks for your answer

i cannot do anything with the source since it is third party costumer and he will not do any changes in the logs..

the year is the only wrong part

the link you sent me is not relevant since i don't have any part of the year and there it is pointing of situations with two digits of the year

there is no timestamp configuration in the sourcetype so i guess it is the default

thanks

Re: set year to timestamp

to4kawa — Mon, 20 Apr 2020 11:30:27 GMT

DATETIME_CONFIG = none at props.conf, and EXTRACT timestamp field and TRANSFORMS
make appropriate timestamp by INGEST_EVAL