french timestamp not understood

[pfoucher]

Hello,
I have a log where the timestamp is written with a abbreviated name for the month. My problem is that the abreviation is a french one and splunk does not understand it.
Example : (déc for december)
01-déc-10|15:28:16.0| xxxx
01-déc-10|15:59:38.3| yyy
As a consequence, all the lines are appended into a single event.
I tried to modify the file datetime.xml, but it didn't work.
Can someone help me ?
Thank you

[raz_gp]

having the same issue for weekdays and month dates. 
Is this something that will happen or we need to fix it ourselves creatively ?


mer. 13 déc. 2023 23:31:20 CET file_hash=96def1...
mar. 19 déc. 2023 22:06:55 CET user=x ... 
mar. 19 déc. 2023 09:16:13 CET user=y ...

[gfuente]

Hello

This is officially not supported:

Note: Splunk Enterprise does not currently recognize non-English month names in timestamps. If you have an app that writes non-English month names to log files, reconfigure the app to use numerical months, if possible.

From: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configuretimestamprecognition

Regards

[lmyrefelt]

The following should work;

in props.conf

["your-sourcetype"]
DATETIME_CONFIG = ("path")/etc/apps/"app-name"/"path"/datetime.xml

inside datetime.xml, under lithmonth / _litmonth

dec|déc

... Well to be honest .. i have not tried using charachters like åæøø yet .. but ...

restart of course

here comes some additional good information;

http://blogs.splunk.com/2014/04/23/its-that-time-again/
http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

[lmyrefelt]

Might be something for an enchantment request? Or the support to help u with ?

Either way .. it should be "best practies" to keep the goods in english 😉 and no puny åæøèé whatever .. makes live easier

[pfoucher]

I tried to modify the datetime.xml file as with your example, but it didn't work. Splunk does not recognize the "é" character, and displays \xE9 instead. This character belongs to UTF-8, it should be recognized, isn't it ?