Hello splunkers,
I have logs in my file
01-03-2018 15:54:58 WARNING [PID:88888][TradeId:11551427] /apps/abcrc/src/check/src/mx_rtpr.cpp:1146 - Sanity Check Exception void sanity_check(void*, rtPRICING_API_LIBRARY*)@/apps/abcrc/Flex/src/mx_rtpr.cpp:1034:End date not equal to option expiry date
that log is of 1st march 2018 but splunk has taken it as a log of 3 January 2018 , please suggest how to manipulate _time field so that my new data or existing data will come in proper time format .
Include TIME_FORMAT
in props.conf
[sourcetype_name]
TIME_FORMAT = %d-%m-%Y %H:%M:%S
Include TIME_FORMAT
in props.conf
[sourcetype_name]
TIME_FORMAT = %d-%m-%Y %H:%M:%S
It would also be good to specify TIME_PREFIX
and MAX_TIMESTAMP_LOOKAHEAD
so splunk knows where the timestamp is located
[sourcetype_name]
TIME_PREFIX = ^
TIME_FORMAT = %d-%m-%Y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20