Getting Data In

Splunk won't correctly recognize timestamp

pero1234
Path Finder

Why splunk won't correctly recognize this timestamp?

120129092233

my props.conf

TIME_FORMAT=%Y%m%d%H%M%S
TIME_PREFIX=^

example of source log:

120129092231;field1 field2  field3
120129092232;field1 field2  field3
120129092233;field1 field2  field3
Tags (2)
1 Solution

imrago
Contributor

try:

TIME_FORMAT=%y%m%d%H%M%S
TIME_PREFIX=^

View solution in original post

imrago
Contributor

try:

TIME_FORMAT=%y%m%d%H%M%S
TIME_PREFIX=^

pero1234
Path Finder

Works! Yes, y% is for year without century like in my log.
Splunk rocks!!

0 Karma

hedgehog
Explorer

Your time_Prefix stanza looks correct but I dont think you need the prefix. Not sure if the docs will shed some light but you can fine them here: http://docs.splunk.com/Documentation/Splunk/latest/Data/
ConfigureTimestampRecognition

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...