Getting Data In

Why doesn't the time format match my log?

kannu
Communicator

Hi splunkers

I have following log entry in file getting indexed on sourcetype name "ncm"

"01/06/2018 12:00:47 : Started LoadBalancer" 

This is of 1st june 2018 but in splunk this entry has been taken as 6 january 2018 . Before this entry comes in the log two days ago i have already changed the time format in props.conf

[ncm]
TIME_FORMAT = %d-%m-%Y %H:%M:%S

So in that two days data arrived as per my time format but today 1st june data went to 6th january .

Please help.

0 Karma
1 Solution

FrankVl
Ultra Champion

That TIME_FORMAT does not match your log. Your log has / as separator, while your TIME_FORMAT uses -. Which will cause Splunk to revert to auto detection, which indeed can fail on ambiguous dates likes 01/06/2018.

View solution in original post

0 Karma

FrankVl
Ultra Champion

That TIME_FORMAT does not match your log. Your log has / as separator, while your TIME_FORMAT uses -. Which will cause Splunk to revert to auto detection, which indeed can fail on ambiguous dates likes 01/06/2018.

0 Karma

kannu
Communicator

@FrankVl

So below will work ?

[ncm]
TIME_FORMAT = %d/%m/%Y %H:%M:%S

0 Karma

FrankVl
Ultra Champion

Yes, I would expect it would 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...