How to parse the date_time and event_time fields from my raw data in PSV format?

[shivarpith]

hi,

i have some mainframe logs coming into splunk which is in PSV (pipe separated value) format. have managed to parse all of the data successfully, but the date_time and Event_time fields are showing dates as 31 dec, 1969 and 1970, but in the log file, it's dated april to june of 2015.

sample log:

IN|15080|830828|V014MSNY|B014MU01|CAL0Q14|DPNT1|PSABTSR1|||0000000|DDTD34|FAIL|10|012||||x980|USER|

[woodcock]

You need to tell Splunk how to interpret the timestamp in each event as documented here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps

Just by looking at your event, I have no idea how to interpret your timestamps so I assume Splunk is treating them as epoch which is giving a time way in the past.