Timestamp issues - Splunk Community

Getting Data In

I have a timestamp that is not coming incorrectly. Splunk is reading the seconds portion of time in my event as minutes.

COMPUTER1, 09/15/2014, 0:00:01 comes across as

9/15/2015 12:01:00 AM

How do I get it to see the seconds as seconds and not minutes?

Use these settings in props.conf for that sourcetype:

...
MAX_TIMESTAMP_LOOKAHEAD=30
TIME_FORMAT=%m/%d/%Y, %k:%M:%S
TIME_PREFIX=^\S+,

The important bit is the %k for hours not prefixed by a zero when in single digits, by default Splunk looks for zero-prefixed hours only.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...