Getting Data In

Why is Splunk converting my timestamp to DD/MM/YY instead of MM/DD/YY?

jmajumdar
Explorer

Hi All

I have this problem in Splunk :

in my log i have time setup as : 12.07.2016 17:20:30,474 but Splunk is converting it to 07/12/16, when it should be 12/07/16. What can I do to correct it? Logs are in these files are in xml format .

This is how it is looking in Splunk:

7/12/16
5:20:30.474 PM  
<unspecified>10.0.6.32<unspecified>10.0.6.32
0 Karma
1 Solution

jmajumdar
Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

View solution in original post

0 Karma

jmajumdar
Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Do you mean the displayed time in the GUI? As Splunk wont rewrite your timestamp. If you mean the way it is displayed in the GUI, this is likely due to the region settings for your language.

Otherwise, it could be that your time stamp is being read incorrectly and you need to specify the strptime format as noted by DBcase, or in props.conf where you ingest the file.

0 Karma

dbcase
Motivator

Try something like this (you will need to substitue the right time format variables for your needs)

eval epochtime=strptime(eventTimeStamp, "%H:%M:%S.%3Q %z %Y-%m-%d")|eval desired_time=strftime(epochtime, "%I:%M:%S.%3Q %p %m/%d/%Y")

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...