Getting Data In

How Do I get Splunk to Recognize a Log TimeStamp and Convert it?

skoelpin
SplunkTrust
SplunkTrust

I have log data that has a timestamp in this format 20160530/001020.670

I uploaded the log directly into Splunk to test with and Splunk is ignoring the timestamp and assigning it's own timestamp which does not match the log data.

I cleared the data from that index and re-uploaded the data and currently on the 'Set Sourcetype' step. There's a section labeled 'Timestamp' which has 'Timestamp format' , 'Timestamp prefix' , and 'Lookahead'..

My question

How can I get Splunk to recognize the timestamp 20160530/001020.670 and convert it to 5/30/16 12:10:20.670 AM?

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Use this

TIME_FORMAT=%Y%m%d/%H%M%S.%3N
TIME_PREFEX=set as per your log
MAX_TIMESTAMP_LOOKAHEAD=17

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Use this

TIME_FORMAT=%Y%m%d/%H%M%S.%3N
TIME_PREFEX=set as per your log
MAX_TIMESTAMP_LOOKAHEAD=17
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...