Getting Data In

default timestamp format

Explorer

My setting in props.conf seems to be not working as expected.
I have put down TIME_FORMAT = %d/%m/%Y %H:%M:%S.%3N
but it is treating 1st May 2012 (01/05/2012) as 5th Jan 2012 (05/01/2012)

props.conf>
TIME_FORMAT = %d/%m/%Y %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD=0

I have checked my user settings as well which is set to use current local (en_GB).
any clue why it is showing otherway round in search?

Thanks

Tags (2)
0 Karma

Legend

Your TIME_FORMAT looks good, however your MAX_TIMESTAMP_LOOKAHEAD doesn't. MAX_TIMESTAMP_LOOKAHEAD defines how many characters relative to (optional) TIME_PREFIX it should use for timestamp extraction, not how many characters relative to TIME_PREFIX before it should start looking. From the docs:

MAX_TIMESTAMP_LOOKAHEAD = <integer>
* Specifies how far (in characters) into an event Splunk should look for a timestamp.
* This constraint to timestamp extraction is applied from the point of the TIME_PREFIX-set location.
* For example, if TIME_PREFIX positions a location 11 characters into the event, and MAX_TIMESTAMP_LOOKAHEAD is set to 10, timestamp extraction will be constrained to characters 11 through 20.

http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf

Explorer

example:
Feed contains "01/05/2012 23:59:59.288,v113,NT...". being interpreted as "05/01/2012 23:59:59.288"

0 Karma

Explorer

the format in the records is in dd/mm/yyyy format, it was working fine when it was first used on the 30th April, but that was probably due to there being no way to confused that date. When 1st May came round then it defaulted to US dates. We have to do the search for all time to get the new records to show (and they are definitely loaded into 5th Jan)

0 Karma

Legend

If that's not the problem, could you paste a sample event?

0 Karma

Legend

Just to check - you're sure that it's not a matter of how the date is formatted when it's output? So for instance if you search last 24 hours, you're not getting these events that seem to be from January 5th?

0 Karma