Archive
Highlighted

TIMEֹֹ_FORMAT configuration

Path Finder

I have a date like May 10 2020 11:20 PM in csv file

Defined in props.conf
TIME_FORMAT - %b %d %Y %I:%M %p

but getting "Failed to parse timestamp"

what I am missing ?

Tags (1)
0 Karma
Highlighted

Re: TIMEֹֹ_FORMAT configuration

Ultra Champion
| makeresults
| eval _raw="May 10 2020 11:20 PM"
| eval _time=strptime(_raw,"%b %d %Y %I:%M %p")

TIME_FORMAT is good.
maybe, timestamp recognition is bad.

0 Karma
Highlighted

Re: TIMEֹֹ_FORMAT configuration

SplunkTrust
SplunkTrust

Please share ALL of the props.conf settings for the sourcetype. Please also share a sample of the CSV file.

---
If this reply helps you, an upvote would be appreciated.
0 Karma