I'm trying to add weblogic 10.3 log files to indexer and I'm struggling to get the timestamp parsed correctly. I'm new to Splunk so may need little bit of more step-through/concept help so please ignore my lack of understanding.
I add the data via local log file. Its more for ad-hoc analysis at this point.. will get to forwarder later!
I specify source type as log4j
In the preview srceen the dates don't match as well as the timestamp is wrong compared to data in log messages.
My log file has data like this
<13/08/2012 12:00:14 AM EST> <[ACTIVE] ExecuteThread: '10' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1344175214433> <Failed to communicate with proxy: xx.xx.xx.xxx/8080. Will try connection xx.xx.xx.xxx/8081 now.
The parsing/output in Preview looks like this
8/6/12 3:00:14.000 PM ####<13/08/2012 12:00:14 AM EST>
As you can see the parsing of the date time isn't working and I get an exclamation mark in preview complaining about 'could not use strptime to parse the timestamp...'
currently applied settings looks like this in preview page:
Hi,I am alse new to Splunk.
I meet the same problem with _time can't mapping with a true log time.
My solution is as below
I go to WLS Server-->server-->your server name-->logging-->advanced-->Date Format Pattern
I change it from yyyy/M/d ahh'時'mm'分'ss'秒' z to yyyy/M/d HH'-'mm'-'ss'-' z
When I restart WLS Server,and I go to Splunk Sever to new a field with name log_time.
Now you can use log_time to search your wls_log like
host=Peter-PC log_time>"2014/11/23 11-00-00", you can get the event occur after 2014/11/23 11-00-00