Getting Data In

Why is my timestamp date format changing from dd/mm/yyyy to mm/dd/yyyy?

sebch
Engager

Hi,

I'm using Splunk Enterprise 6.5.0 with Universal forwarders 6.5.0 for some years now to index log files from .Net webapp.

Forwarders are looking into a directory where each days a new file is created, with a name like webapp.%ddmmyyy%.log.

The log file content looks like that, no date information :

14:25:57.023 [9] DEBUG Log4NetManager - %Lots of Data%
14:25:58.383 [9] DEBUG Log4NetManager - % Data%

From the 1st of each month to the 12th, the data are classified in Splunk using a date format like mm/dd/yyyy. => Wrong
Then, from the 13th to the end of the month data are classified in this format dd/mm/yyyy. => Right

Example :
log files in date of the 12th of May 2016 is classified under the 5th of December 2016
log files in date of 13th of May 2016 is classified the right way

I can see that doing some searches within Splunk Web.

I never specified any date format in any .conf file in Splunk, and it always worked like charm.
Any idea about what am I missing?

Thanks in advance for your help!

0 Karma
1 Solution

sebch
Engager

Think I've found my answer.

I had to configure a new source type (clone of log4j), modified the Timestamp from "Auto" to "Current time" and set sourcetype parameter on Forwarders input.conf files to my cloned log4j source type.

That's it.

View solution in original post

0 Karma

sebch
Engager

Think I've found my answer.

I had to configure a new source type (clone of log4j), modified the Timestamp from "Auto" to "Current time" and set sourcetype parameter on Forwarders input.conf files to my cloned log4j source type.

That's it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If that does in fact solve your problem then please Accept your answer to help others find it in the future.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...