I have the following line in props.conf
TIME_FORMAT = %m/%d/%Y %H:%M:%S
I have the following timestamp:
"2/23/2013 9:21:21"
Splunk can recognize that. However, without the leading 0 in minutes or seconds (if value is less than 10), Splunk cannot recognize the timestamp.
"2/23/2013 9:1:01"
"2/23/2013 9:01:1"
How can this be fixed?
Very good idea indeed. If possible (or required) you could/should also add subseconds and TZ.
/k
I ended up simply changing my timestamp so that it has 2 digits for minutes and seconds
You can give %#M and %#S a try.
When I have "2/23/2013 9:1:01", it thinks it is "2/23/2013 1:01:00" and skips the hour.
All other cases that have 1 digit as M or S will simply use index time as the event time stamp
For me even %m/%d/%Y %H:%M:%S works well with all these timestamps:
2/23/2013 9:1:1
2/23/2013 9:01:1
2/23/2013 9:1:01
2/23/2013 9:01:01
TIME_FORMAT = %m/%d/%Y %k:%#M:%#S
This still seems to need the leading zero
Try with %k
or %l
instead of %H
(depending on whether you have 0-24 or 0-12 for the hour. Since there is no AM/PM in your timestamp, I'd guess that you have a 24-hour clock.
Hope this helps,
Kristian
Thanks for the info about %k
oops, just saw that you had the same problem for minutes and seconds... hmm... mm...mmm....