Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Correct TIME_FORMAT for the following timestamp?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Correct TIME_FORMAT for the following timestamp?
Hello,
I'm having trouble extracting the following timestamp for one source, is there someone here that can recommend what values to put into the $SPLUNK_HOME/etc/system/default/local file under the TIME_FORMAT attribute?
Mon Oct 8 12:15:10 EST 2012:
That is currently being indexed as 10/9/12 4:15:10.000 AM when it should be 8/10/12 12:15:10 AM.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am still unsuccessful in configuring this, can anybody see anything that I am missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am looking at the newer ones, I fed new data into it after making the changes and restarting the service.
My gut feeling is that the props file is not being called...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you looking for timestamps in new events or old ones? Events that have already been indexed will not be affected by this change, because they already have their timestamp set.
Otherwise check splunkd.log for messages related to strptime time extraction, to see what error it is throwing. You MIGHT need to include an extra ":" at the end in your TIME_FORMAT.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn, perhaps you can help me further, I placed the following in /opt/splunk/etc/system/local/props.conf:
[source::/directory/structure/logfile.log]
TIME_FORMAT = %a %b %e %H:%M:%S %Z %Y
Then restarted the service and fed more data into the log however it is still not recognising the timestamp. Is there something which I am doing wrong that you can see?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
%a %b %e %H:%M:%S %Z %Y
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
