Getting Data In

Why is Splunk converting my timestamp to DD/MM/YY instead of MM/DD/YY?

Explorer

Hi All

I have this problem in Splunk :

in my log i have time setup as : 12.07.2016 17:20:30,474 but Splunk is converting it to 07/12/16, when it should be 12/07/16. What can I do to correct it? Logs are in these files are in xml format .

This is how it is looking in Splunk:

7/12/16
5:20:30.474 PM  
<unspecified>10.0.6.32<unspecified>10.0.6.32
0 Karma
1 Solution

Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

View solution in original post

0 Karma

Explorer

Added this to props.conf seem to resolve my issue : DATETIME_CONFIG=CURRENT

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Do you mean the displayed time in the GUI? As Splunk wont rewrite your timestamp. If you mean the way it is displayed in the GUI, this is likely due to the region settings for your language.

Otherwise, it could be that your time stamp is being read incorrectly and you need to specify the strptime format as noted by DBcase, or in props.conf where you ingest the file.

0 Karma

Motivator

Try something like this (you will need to substitue the right time format variables for your needs)

eval epochtime=strptime(eventTimeStamp, "%H:%M:%S.%3Q %z %Y-%m-%d")|eval desired_time=strftime(epochtime, "%I:%M:%S.%3Q %p %m/%d/%Y")

https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!