Getting Data In

Timestamp format

Vladimir
Path Finder

Hi,

I have log files which have timestamp format like

04/10/2012 07:50:09 - dd/mm/yyyy HH:MM:SS

but indexer thinks it's a mm/dd instead of dd/mm. Logs are monitored by forwarder which has a props.conf

[source::E:\Logging\] 
TIME_FORMAT = %d/%m/%Y %H:%M:%S

But still nothing changed. Data with timestamp, for example 04/10/2012 I can find for April, but not for October. Any suggestions?
Splunk forwarder version - 4.3.4, splunk indexer - 4.3

Tags (1)
1 Solution

echalex
Builder

The TIME_FORMAT needs to specified in your props.conf. Furthermore, it is relevant to the Splunk server that does the parsing. In other words, if your using a universal forwarder, you need to edit your props.conf on the indexer.

The alternative is to use a heavy forwarder to do parsing.

View solution in original post

echalex
Builder

The TIME_FORMAT needs to specified in your props.conf. Furthermore, it is relevant to the Splunk server that does the parsing. In other words, if your using a universal forwarder, you need to edit your props.conf on the indexer.

The alternative is to use a heavy forwarder to do parsing.

Vladimir
Path Finder

ok, got it. Will try to configure the indexer

0 Karma

Vladimir
Path Finder

and one more thing - this issue started from October only, for last months I didn't have such problem

0 Karma
Get Updates on the Splunk Community!

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...