Hi all
I have the following log:
09-feb-14 10:54:06.501
Splunk parses this date as 2009-02-14 (year-month-day)
Because i want the 09 as my day i tried using following time_format:
%d-%m-%Y %H:%M:%S
This gives an error
Thanks in advance
Yes, %m
is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b
. Also, you might want to change the %Y
to %y
, since you only represent the year with two digits. Then you can add the milliseconds as well.
TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N
/K
Yes, %m
is the numeric representation of a month, i.e. 01, 02, 03 etc. What you want is the variable for the abbreviated alphabetic version, which is %b
. Also, you might want to change the %Y
to %y
, since you only represent the year with two digits. Then you can add the milliseconds as well.
TIME_FORMAT = %d-%b-%y %H:%M:%S.%3N
/K
Worked like a charm, great site also. Thanks