Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Timestamp format
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vladimir
Path Finder
10-05-2012
04:21 AM
Hi,
I have log files which have timestamp format like
04/10/2012 07:50:09 - dd/mm/yyyy HH:MM:SS
but indexer thinks it's a mm/dd instead of dd/mm. Logs are monitored by forwarder which has a props.conf
[source::E:\Logging\]
TIME_FORMAT = %d/%m/%Y %H:%M:%S
But still nothing changed. Data with timestamp, for example 04/10/2012 I can find for April, but not for October. Any suggestions?
Splunk forwarder version - 4.3.4, splunk indexer - 4.3
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
echalex
Builder
10-05-2012
04:28 AM
The TIME_FORMAT needs to specified in your props.conf. Furthermore, it is relevant to the Splunk server that does the parsing. In other words, if your using a universal forwarder, you need to edit your props.conf on the indexer.
The alternative is to use a heavy forwarder to do parsing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
echalex
Builder
10-05-2012
04:28 AM
The TIME_FORMAT needs to specified in your props.conf. Furthermore, it is relevant to the Splunk server that does the parsing. In other words, if your using a universal forwarder, you need to edit your props.conf on the indexer.
The alternative is to use a heavy forwarder to do parsing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vladimir
Path Finder
10-05-2012
04:31 AM
ok, got it. Will try to configure the indexer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vladimir
Path Finder
10-05-2012
04:24 AM
and one more thing - this issue started from October only, for last months I didn't have such problem
Get Updates on the Splunk Community!
Dashboards: Hiding charts while search is being executed and other uses for tokens
There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...
Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...
This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...
Brains, Bytes, and Boston: Learn from the Best at .conf25
When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...
