<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Splunk not recognizing the date format in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362702#M107145</link>
    <description>&lt;P&gt;try and  remove the square brackets around your time format &lt;/P&gt;</description>
    <pubDate>Fri, 11 Aug 2017 13:51:04 GMT</pubDate>
    <dc:creator>adonio</dc:creator>
    <dc:date>2017-08-11T13:51:04Z</dc:date>
    <item>
      <title>Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362701#M107144</link>
      <description>&lt;P&gt;Splunk is not recognizing the date and time of my data correctly.&lt;BR /&gt;
My data is in the &lt;A href="https://en.wikipedia.org/wiki/Common_Log_Format"&gt;common log format&lt;/A&gt;.  An example of a line would be:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;192.168.2.1 Logname Username [02/Aug/2002:20:16:59 -0700] "GET /img/pic.jpg HTTP/1.0" 200 56812
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where 02/Aug/2002 would be the date, 20:16:59 the time and -0700 the timezone.&lt;BR /&gt;
It has a unique sourcetype that is correctly assigned.&lt;BR /&gt;
When searching for the data the _time field shows incorrect and semi-random values.&lt;/P&gt;

&lt;P&gt;My props.conf:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[mysourcetype]
TIME_FORMAT=[%d/%b/%Y:%H:%M:%S %z]
TIME_PREFIX=^
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The time format shows the correct regex in Splunk Web under Sourcetypes, so my props.conf gets loaded.&lt;/P&gt;</description>
      <pubDate>Fri, 11 Aug 2017 07:01:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362701#M107144</guid>
      <dc:creator>oliverkunert</dc:creator>
      <dc:date>2017-08-11T07:01:31Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362702#M107145</link>
      <description>&lt;P&gt;try and  remove the square brackets around your time format &lt;/P&gt;</description>
      <pubDate>Fri, 11 Aug 2017 13:51:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362702#M107145</guid>
      <dc:creator>adonio</dc:creator>
      <dc:date>2017-08-11T13:51:04Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362703#M107146</link>
      <description>&lt;P&gt;Try these props.conf settings.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[mysourcetype]
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 11 Aug 2017 13:57:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362703#M107146</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2017-08-11T13:57:15Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362704#M107147</link>
      <description>&lt;P&gt;try below,&lt;/P&gt;

&lt;P&gt;[mysourcetype]&lt;BR /&gt;
TIME_FORMAT=\[%d/%b/%Y:%H:%M:%S %z\]&lt;BR /&gt;
TIME_PREFIX=^\d+\.\d+\.+d\.\d+\s\S+\s\S+\s\[&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 15:20:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362704#M107147</guid>
      <dc:creator>sbbadri</dc:creator>
      <dc:date>2020-09-29T15:20:23Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362705#M107148</link>
      <description>&lt;P&gt;It won't work with &lt;CODE&gt;\[&lt;/CODE&gt; in both &lt;CODE&gt;TIME_PREFIX&lt;/CODE&gt; and &lt;CODE&gt;TIME_FORMAT&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Fri, 11 Aug 2017 14:23:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362705#M107148</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2017-08-11T14:23:48Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk not recognizing the date format</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362706#M107149</link>
      <description>&lt;P&gt;After I used your configuration the problem still persisted. After removing the date from extracted fields for the search it worked.&lt;/P&gt;</description>
      <pubDate>Wed, 16 Aug 2017 07:18:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-not-recognizing-the-date-format/m-p/362706#M107149</guid>
      <dc:creator>oliverkunert</dc:creator>
      <dc:date>2017-08-16T07:18:00Z</dc:date>
    </item>
  </channel>
</rss>

