topic using access-combined I am not able to get the correct date in Getting Data In

using access-combined I am not able to get the correct date

sphariss — Mon, 28 Sep 2020 13:33:52 GMT

I am having problems getting splunk to read my log file correctly. as you can see from the below example, the reported dates are WAY off from reality.

These are the values that SPLUNK is giving me for the date (exported to csv file):

date_hour = 23
date_mday = 20
date_minute = 55
date_month = febuary
date_second = 9
date_wday = saturday
date_year = 2010
date_zone = -420

This is the corresponding RAW log line, as you can see, there is no Feb 9, 2010 date for it to grab. It does appear to grab the correct time, but the date and the timezone is incorrect.

99.123.123.123 - - [23/Feb/2013:23:55:09 -0700] "GET /page.php HTTP/1.1" 200 15745 "http://www.website.com/page.php" "Mozilla/5.0 (iPad; CPU OS 6_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B141 Safari/8536.25"

Re: using access-combined I am not able to get the correct date

kristian_kolb — Thu, 21 Mar 2013 08:11:31 GMT

All right, there seems to be something wrong with how Splunk parses the timestamp. I think you need to explicitly configure how this is parsed - through the following config parameters in props.conf;

TIME_PREFIX
TIME_FORMAT
MAX_TIMESTAMP_LOOKAHEAD

http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf

For TIME_FORMAT it will be good to know how to specify the strptime variables, see http://www.strftime.net

I believe that your props.conf should look something like;

[your sourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
the rest of your props parameters here

These settings should go into a props.conf file on the indexer (or the heavy forwarder if you use that).

Hope this helps,

Kristian