Getting Data In

setting the default date format for events

las
Contributor

I have a date in my input files 08-11-12, This date could be August 11. 2012, or (as is the case) November 8. 2012, as I use European date-format.

It looks like Splunk likes to use the American date-format before using the European, so it thinks the event was written in august.

How do I change the default behavior, so that it first uses European format, and then American?

Kind regards

Tags (1)
0 Karma
1 Solution

las
Contributor

I used the comment from dart.
A little more work, but it works.

View solution in original post

0 Karma

las
Contributor

I used the comment from dart.
A little more work, but it works.

0 Karma

las
Contributor

Thanks - as usual very helpful info.

0 Karma

dart
Splunk Employee
Splunk Employee

It's better to do this with a TIME_FORMAT for each sourcetype, but otherwise you could create your own datetime.xml and then use the default stanza to specify using your copy of datetime.xml.

Ayn
Legend

These issues are typically found on a per-sourcetype basis, so setting a global default is kind of dangerous. But, if you really know what you are doing you could set a global setting using the [default] stanza in props.conf.

las
Contributor

Yes, but isn't that on a sourcetype basis. I want to default use the European formats before the American.

0 Karma

kristian_kolb
Ultra Champion

Check out the TIME_FORMAT parameter for props.conf. With that you specify how the incoming timestamps should be parsed.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...