Splunk Not Recognizing Timestamps – What Settings Should I Use?

[splunk_user_99]

Hello everyone,

I’m having trouble getting Splunk to recognize timestamps correctly, and I hope someone can help me out. I’m importing an access log file, where the timestamps are formatted like this:

[01/Jan/2017:02:16:51 -0800]

here also a live output:

However, Splunk is not recognizing these timestamps and instead assigns the indexing time.

I have tried adjusting the settings in the sourcetype configuration (see screenshot) and have set the following values:

• Timestamp format: %d/%b/%Y:%H:%M:%S %z

• Timestamp prefix: \[

• Lookahead: 32

Unfortunately, the timestamps are still not recognized correctly.

👉 Do I need to modify props.conf or inputs.conf as well?

👉 Is my timestamp format correct, or should it be defined differently?

👉 Could there be another issue in my extraction settings?

The log file looks like this:

Should I maybe change the log file with some scripting in order to change the format?

I would really appreciate any guidance! Thank you in advance. 😊

Best regards

[livehybrid · Accepted solution]

It looks like your time extraction settings are corrrect, however you need to add MAX_DAYS_AGO to be a higher value (eg 3000) for Splunk to accept that 2017 timestamp as the default is 2000 and therefore Splunk is not accepting the date.

Let me know if adding MAX_DAYS_AGO=3000 to your extraction config works!

Good luck

Will

[splunk_user_99]

Hey Will,

I just wanted to say a huge THANK YOU for your help! 🙌

Your suggestion to increase MAX_DAYS_AGO to 3000 completely solved my issue, and Splunk now correctly recognizes my timestamps.

Honestly, I had been struggling with this for quite some time, and your solution saved me a lot of time and frustration. I really appreciate the effort you put into answering my question.

Thanks again, and have a great day! 🚀

Best,

Emil