Getting Data In

Timestamp parsed incorrectly

timgtallongs
Engager

Hi all

I have the following log:

09-feb-14 10:54:06.501 [w3wp.1320] {VproofApi}proofApi.GetOpenSessionscalled.

Splunk parses this date as 2009-02-14 (year-month-day)

Because i want the 09 as my day i tried using following time_format:

%d-%m-%Y %H:%M:%S

This gives an error

Thanks in advance

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Yes, %m is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b. Also, you might want to change the %Y to %y, since you only represent the year with two digits. Then you can add the milliseconds as well.

TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N

http://www.strftime.net

/K

View solution in original post

kristian_kolb
Ultra Champion

Yes, %m is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b. Also, you might want to change the %Y to %y, since you only represent the year with two digits. Then you can add the milliseconds as well.

TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N

http://www.strftime.net

/K

timgtallongs
Engager

Worked like a charm, great site also. Thanks

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...