Timestamp parsed incorrectly

[timgtallongs]

Hi all

I have the following log:

09-feb-14 10:54:06.501 [w3wp.1320] {VproofApi}proofApi.GetOpenSessionscalled.

Splunk parses this date as 2009-02-14 (year-month-day)

Because i want the 09 as my day i tried using following time_format:

%d-%m-%Y %H:%M:%S

This gives an error

Thanks in advance

[kristian_kolb · Accepted solution]

Yes, %m is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b. Also, you might want to change the %Y to %y, since you only represent the year with two digits. Then you can add the milliseconds as well.

TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N

http://www.strftime.net

/K

[timgtallongs]

Worked like a charm, great site also. Thanks