Correct Timestamp

[matthewcanty]

Problem. Just got back into office and found that logs for the 1st - 6th June, went to 6th Jan, 6th Feb, 6th Mar and so on. Meaning my datetime - dd-MM-yy hh:mm:ss,ffff - is being misrepresented by the american datetime format - swapping day for month.

What is the correct way to format the date? And is there a way to fix where the raw data is being processed not as I intended.

[kristian_kolb · Accepted solution]

Unfortunately there is no 'correct' way to format dates, and there are several popular variants, such as YYYY-mm-dd HH:MM:SS or mm/dd/YY. However, Splunk recognizes most of them quite well, but naturally there are situations where a date can be ambiguous e.g. 05/03/11.

In those cases, it might be neccessary to instruct Splunk how to parse these correctly. This is done in props.conf on the server where the parsing phase takes place. Normally this is on the indexer, but if your files are coming through a full/heavy forwarder you'd do the configuration there instead.

in props.conf

[your_sourcetype]
TIME_FORMAT = %m/%d/%Y    

or whatever your actual time format is.

Unfortunately you cannot change what has already been indexed...

Check out the docs for props.conf;
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf and for information on which config goes where in general;
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Hope this helps,

Kristian

[matthewcanty]

Thanks for the info. I have changed the props.conf according to http://splunk-base.splunk.com/answers/45237/choosing-the-correct-timestamp also I have modified the date-time format to yyyy/MM/dd etc.