Getting Data In

props.conf date and time formatting

khhenderson
Path Finder

I have log files that I would like to get into Splunk but I'm having trouble due to the way the date and time are formatted in the log file. In the past I have add a few lines to the props.conf on the splunk server.

Here is what I have in the props.conf

[source::/pathtofile/logserver_output/LogServer.*]
TIME_PREFIX = ^L
TIME_FORMAT = %y_%m_%d.%H_%M_%S

Here is a line from the log file.

L2014_01_22.09_35_17{CONVERTED=TRUE,ENE_TIME=0.003,RECORD_NAMES=Record54B43821-6D76-40B6-B5AD-9794DCF445F0,SESSION_ID=acca42e8-3c0f-4b9a-b252-a587dc4de3fb,TYPE=R}

It should be "L" "year" "month" "day" "." "hour" "minute" "second".

Did I miss something? I am using a test index but it doesn't seem to be reading the date and time correctly.

Tags (2)
1 Solution

aelliott
Motivator

I believe you need a capital y: %Y

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Four-digit years are represented by '%Y'.

---
If this reply helps you, Karma would be appreciated.
0 Karma

aelliott
Motivator
0 Karma

khhenderson
Path Finder

What about month and minute, should they both be capital?

0 Karma

aelliott
Motivator

I believe you need a capital y: %Y

khhenderson
Path Finder

That did the trick, I knew it was something simple. Thanks

0 Karma
Get Updates on the Splunk Community!

App Building 101 - Build Your First App!

WATCH RECORDING NOW   Tech Talk: App Dev Edition Splunk has tons of out-of-the-box functionality, and you’ve ...

Introducing support for Amazon Data Firehose in Splunk Edge Processor

We’re excited to announce a powerful update to Splunk Data Management with added support for Amazon Data ...

The Observability Round-Up: September 2024

What’s up Splunk Community! Welcome to the latest edition of the Observability Round-Up, a monthly series in ...