Getting Data In

24hour timestamps parse incorrectly


I have a subset of servers that all of their logs parse the timestamps incorrectly at 12 (noon)..

sample log lines:


The following all index into splunk as 12PM

May 14 12:00:31 resin_stdout: : [12:00:31.153] [SCAN_QUEUE ][WARN ]SaScanQueueServlet: Finished (4ms)
May 14 12:00:56 resin_stdout: : [12:00:56.492] [MEMORY ][WARN ]AppMem=25295248 TotalMem=62128128
May 14 12:00:56 resin_stdout: : [12:00:56.494] [SCAN_SEND ][WARN ]SaCronSendCompletedServlet: Finished (342ms)


The following all index into splunk as 12AM

May 14 12:00:02 resin_stdout: : [12:00:01.605] [MEMORY     ][WARN ]AppMem=26510144 TotalMem=69664768
May 14 12:00:31 resin_stdout: : [12:00:31.624] [SCAN_QUEUE ][WARN ]SaScanQueueServlet: Finished (7ms)
May 14 12:00:51 resin_stdout: : [12:00:51.622] [SCAN_SEND  ][WARN ]SaCronSendCompletedServlet: Finished (0ms)

I have a subset of 17 servers, that parse incorrectly, the ONLY difference I can find is the hostnames.

has anyone encountered this behavior, and have any idea if there is a fix around this?
All logs are in 24HR format fo "midnight" hour shows as 00:00:00, while "noon" as 12:00:00

Tags (2)
0 Karma


This turned out to be a simple oversight. It seems that the parser was picking up the "am" from the begining of my hostname in the next field. Hence only happening on machines names "am....."

Fix =
Add the following to my stanza's in props.conf


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>