Archive

Splunk Input List of All accepted Default Time Formats

Contributor

Is there a document or configuration file that spells out all of the accepted default time formats on input. In other words, what are ALL the date/time formats that are accepted if I do not specify a format string in props.conf?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You really should specify TIME_FORMAT in props.conf for all your sourcetypes. It's a Splunk Best Practice.
Default time formats are in $SPLUNK_HOME/etc/datetime.xml.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

You really should specify TIME_FORMAT in props.conf for all your sourcetypes. It's a Splunk Best Practice.
Default time formats are in $SPLUNK_HOME/etc/datetime.xml.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post