Splunk Search

How do I get Splunk to recognize the full Date AND Time in the timestamp of this CSV?

jimmitch923
New Member

Event lines look like this
{I5K5-M8HD47HI-6694GOIH},01/02/2010 07:13:39,NLR0174,PC-8272,Connect

Everything I've tried only recognizes the time...but not the date.
TIME_FORMAT = %d/%m/%Y %H:%M:%S
TIME_PREFIX = {.+}\,

Help please!

Tags (1)
0 Karma

Jeremiah
Motivator

Are the dates really that old? You may need to increase MAX_DAYS_AGO. Does it work differently for more recent timestamps?

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf

MAX_DAYS_AGO = <integer>
* Specifies the maximum number of days past, from the current date, that an
  extracted date can be valid. Splunk still indexes events with dates older
  than MAX_DAYS_AGO with the timestamp of the last acceptable event. If no 
  such acceptable event exists, new events with timestamps older than MAX_DAYS_AGO 
  will use the current timestamp.
* For example, if MAX_DAYS_AGO = 10, Splunk applies the timestamp of the last 
  acceptable event to events with extracted timestamps older than 10 days in 
  the past. If no acceptable event exists, Splunk applies the current timestamp.
* Defaults to 2000 (days), maximum 10951.
* IMPORTANT: If your data is older than 2000 days, increase this setting.
0 Karma

sheron_splunk
Splunk Employee
Splunk Employee

Have you tried using MAX_TIMESTAMP_LOOKAHEAD=19 ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...