Timestamp index do not consider hours

[nolivieri]

Hi all,

I've a csv with a timestamp like this:

2012-05-14 08

which is, of course, in the form:

%Y-%m-%d %H

Unfortunately, when trying to index it, it only takes the date:

14/05/12 00.00.00,000

How can I make it aware of the hour? Obviously it would have minutes and seconds equals to "00"...
Thanks a lot, bye!!

Edit: here is the screenshot:

[Ayn]

You need to tell Splunk how to parse the timestamp by providing the appropriate format in the TIME_FORMAT configuration directive in props.conf.

[my_sourcetype]
TIME_FORMAT = %Y-%m-%d %H

This will apply to events that get indexed after you've made the changes and restarted Splunk (so events that already exist in the index will not be affected).

More information on configuring timestamp recognition here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition

[nolivieri]

I've already done it by setting it in the web interface while importing the new datas...I'll try to attach a screenshot of what I already have...