how to format date without year in the time stamp

[Kozanic]

I have a file that I'm trying to get the date right on - but am not having much success, and haven't been able to find a solution as yet.

Time stamp format is as below:
09/23 16:30:01.55

This is at the start of the event line with other information following.

I have tried using: TIME_FORMAT=%d/%m %H:%M:%S.%2N

however, this gives me: 9/20/01 6:24:41.550 AM

2 things I would like to try and achieve are:

1. Getting the date format correct for the date that is being presented
2. if possible, append the year to the event

[markthompson]

You could try using the convert command.

---

convert timeformat=%d/%m ctime(Time)

---

This should work I think, I've used it in a graph to change the time stamp, but not the date, I think it should still apply.

[Kozanic]

Thanks Mark,

Am I able to use convert at index time?

I have tried your suggestion, but does seem to make any different to the Timestamp being generated.

[markthompson]

Hi Kozanic,
Do you mean at the time that it indexes the file? If so, I don't think you can, but it can be used in search queries,
Otherwise I think you could use this solution; http://answers.splunk.com/answers/525/how-can-i-change-the-time-format-in-splunk-web.html

Hope this helps 🙂

[Kozanic]

Thanks sk314, I hadn't, but I have tried and it doesn't seem to be working for me - not sure if I'm doing it wrong somehow.

Will continue to play and see what I can work out.

[sk314]

have you looked at this answer? http://answers.splunk.com/answers/37896/date-without-year-wrong-index.html

[Kozanic]

Minor edit:
TIME_FORMAT=%m/%d %H:%M:%S.%3N