Why is my timestamp not being recognized...

[a212830]

Hi,

I have the following data coming in:

10009 SYSTEM 03/05/17 11:12:44 Info Message Partner MQCACTUSOUT, Session 611 - Message sent
    Sequence number : 242034
    UUMID           : OCHASUS33XXX9002556093123JY    
    Suffix          : 1705031356750
 - lrtAZ842

The problem is, instead of interpresting the date as May 3rd, it's being interpreted as March 5th. My props has the following, which looks correct to me.

[swift_alarmsmsgs]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
ANNOTATE_PUNCT=false
KV_MODE=auto
LINE_BREAKER = ([\r\n]+)\d{5}
TIME_FORMAT = %d/%m/%y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=50

[gcusello]

Hi a212830,
for me the best approach to a timestamp problem is to download an example of your log in a file and try to ingest it using the Splunk web gui.
In this way you can immediately check your configurations and verify problems.

In your specific situation, the problem could be in MAX_TIMESTAMP_LOOKAHEAD=18 and TIME_PREFIX=\d+\s\w+\s

Bye.
Giuseppe

[DalJeanis]

Upvote for likely correct TIME_PREFIX to fix the OP's issue.

[sloshburch]

Agreed. I was gonna say TIME_PREFIX as well.