Getting Data In

how to format date without year in the time stamp

Kozanic
Path Finder

I have a file that I'm trying to get the date right on - but am not having much success, and haven't been able to find a solution as yet.

Time stamp format is as below:
09/23 16:30:01.55

This is at the start of the event line with other information following.

I have tried using: TIME_FORMAT=%d/%m %H:%M:%S.%2N

however, this gives me: 9/20/01 6:24:41.550 AM

2 things I would like to try and achieve are:

  1. Getting the date format correct for the date that is being presented
  2. if possible, append the year to the event
0 Karma

markthompson
Builder

You could try using the convert command.


convert timeformat=%d/%m ctime(Time)

This should work I think, I've used it in a graph to change the time stamp, but not the date, I think it should still apply.

0 Karma

Kozanic
Path Finder

Thanks Mark,

Am I able to use convert at index time?

I have tried your suggestion, but does seem to make any different to the Timestamp being generated.

0 Karma

markthompson
Builder

Hi Kozanic,
Do you mean at the time that it indexes the file? If so, I don't think you can, but it can be used in search queries,
Otherwise I think you could use this solution; http://answers.splunk.com/answers/525/how-can-i-change-the-time-format-in-splunk-web.html

Hope this helps 🙂

0 Karma

Kozanic
Path Finder

Thanks sk314, I hadn't, but I have tried and it doesn't seem to be working for me - not sure if I'm doing it wrong somehow.

Will continue to play and see what I can work out.

0 Karma

sk314
Builder
0 Karma

Kozanic
Path Finder

Minor edit:
TIME_FORMAT=%m/%d %H:%M:%S.%3N

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...