Getting Data In

set year to timestamp

sarit_s
Communicator

Hello

I'm getting logs from my customer and the timestamp there is day and month without year.
that case causes splunk to index the events with future dates
example:

12/31/20 11:59:59.000 PM Dec 31 23:59:59 csm kerne

how can i modify the date before indexing so i will see the correct timestamp ?

thanks

0 Karma

to4kawa
Ultra Champion

DATETIME_CONFIG = none at props.conf, and EXTRACT timestamp field and TRANSFORMS
make appropriate timestamp by INGEST_EVAL

0 Karma

PavelP
Motivator

Hello @sarit_s ,

actually 12/31/20 looks like a date (31 Dec 2020), just wrong one. I'd try to solve it on the log source side if possible.

0 Karma

sarit_s
Communicator

Hey
thanks for your answer

i cannot do anything with the source since it is third party costumer and he will not do any changes in the logs..

the year is the only wrong part

the link you sent me is not relevant since i don't have any part of the year and there it is pointing of situations with two digits of the year

there is no timestamp configuration in the sourcetype so i guess it is the default

thanks

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...