Getting Data In

Why is Splunk converting my timestamp to DD/MM/YY instead of MM/DD/YY?

jmajumdar
Explorer

Hi All

I have this problem in Splunk :

in my log i have time setup as : 12.07.2016 17:20:30,474 but Splunk is converting it to 07/12/16, when it should be 12/07/16. What can I do to correct it? Logs are in these files are in xml format .

This is how it is looking in Splunk:

7/12/16
5:20:30.474 PM  
<unspecified>10.0.6.32<unspecified>10.0.6.32
0 Karma
1 Solution

jmajumdar
Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

View solution in original post

0 Karma

jmajumdar
Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Do you mean the displayed time in the GUI? As Splunk wont rewrite your timestamp. If you mean the way it is displayed in the GUI, this is likely due to the region settings for your language.

Otherwise, it could be that your time stamp is being read incorrectly and you need to specify the strptime format as noted by DBcase, or in props.conf where you ingest the file.

0 Karma

dbcase
Motivator

Try something like this (you will need to substitue the right time format variables for your needs)

eval epochtime=strptime(eventTimeStamp, "%H:%M:%S.%3Q %z %Y-%m-%d")|eval desired_time=strftime(epochtime, "%I:%M:%S.%3Q %p %m/%d/%Y")

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...