Getting Data In

How to edit props.conf so Splunk will recognize a month's time format when the month is in all caps?

splk5000
New Member

Seeking help with TIME_FORMAT in props.conf.

I'm trying to get Splunk to recognize a time format in the form of "JAN 3 2016". Seems simple enough, but none of the strptime fields address the month field with all caps. For example if it was instead "Jan 3 2016" where only the "J" is capitalized I could use TIME_FORMAT = "%b %e %Y". But because the month is in the format of "JAN" the %b does not recognize the month. Recommendations on how to set TIME_FORMAT?

0 Karma
1 Solution

niketn
Legend

Would you be able to give the complete date string for timestamp? Also few sample events?

For the following data strptime timestamp format %b %d %Y %H:%M:%S.%3N worked for me:

JAN 3 2016 20:17:13.000, my test data line 1
JAN 3 2016 20:17:14.000, my test data line 2
JAN 3 2016 20:17:15.000, my test data line 3

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

cdoebert
Path Finder

strptime() is case-insensitive, so there might be something else at fault.

0 Karma

splk5000
New Member

Thank you!

0 Karma

cdoebert
Path Finder

You're welcome, but we can help you get to the bottom of the problem!

Like niketnilay said, if we had a complete date string or a few sample events, we can track down what might really be going on.

0 Karma

niketn
Legend

Would you be able to give the complete date string for timestamp? Also few sample events?

For the following data strptime timestamp format %b %d %Y %H:%M:%S.%3N worked for me:

JAN 3 2016 20:17:13.000, my test data line 1
JAN 3 2016 20:17:14.000, my test data line 2
JAN 3 2016 20:17:15.000, my test data line 3

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@splk5000 I have converted my comment to answer since %d resolved the issue in this case.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

splk5000
New Member

It seems that %b wasn't the variable causing the trouble; the discrepancy was using the %e instead of %d. When I used %d it properly extracted the date.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...