set year to timestamp

[sarit_s]

Hello

I'm getting logs from my customer and the timestamp there is day and month without year.
that case causes splunk to index the events with future dates
example:

12/31/20 11:59:59.000 PM Dec 31 23:59:59 csm kerne

how can i modify the date before indexing so i will see the correct timestamp ?

thanks

[to4kawa]

DATETIME_CONFIG = none at props.conf, and EXTRACT timestamp field and TRANSFORMS
make appropriate timestamp by INGEST_EVAL

[PavelP]

Hello @sarit_s ,

actually 12/31/20 looks like a date (31 Dec 2020), just wrong one. I'd try to solve it on the log source side if possible.

• Can you check the date on the source machine?
• Is the date 12/31/20 completely wrong or the year only?
• Have you patched your splunk against the timestamp issue?: https://docs.splunk.com/Documentation/Splunk/8.0.3/ReleaseNotes/FixDatetimexml2020
• Can you show your current TIME_FORMAT?

[sarit_s]

Hey
thanks for your answer

i cannot do anything with the source since it is third party costumer and he will not do any changes in the logs..

the year is the only wrong part

the link you sent me is not relevant since i don't have any part of the year and there it is pointing of situations with two digits of the year

there is no timestamp configuration in the sourcetype so i guess it is the default

thanks