Date Parsing

[nickhills]

Hello all,
We have just encountered a problem with date parsing as we have progressed into the new month.

Our log files output a date and time stamp in the following pattern:

02-07-2012 @ 12:15:23.211

This has been fine up until 1st July, wherein splunk is now parsing the above log line, as the 7th Feb, instead of 2nd of the 7th.

I have created a entry in my props.conf file for this sourcetype, and defined the following:

TIME_FORMAT = %d-%m-%Y @ %H:%M:%S.%3N

But this has not resolved the issue, is there something wrong with my Time format, and why would this only just have started (as of 1st July)

[Ayn · Accepted solution]

You have the percent sign on the wrong side. The percent signs should go before the format, so:

%d-%m-%Y @ %H:%M:%S.%3N

[nickhills]

In the end i solved this by changing the date format in my logs.

Whilst this did not solve my initial problem, Ayn correctly pointed out that my syntax was wrong.

[nickhills]

Ayn,

Sorry - thats my mistake when typing the question.
The config in use is as per your correction above, however the parsing is incorrect