Getting Data In

setting the default date format for events

Contributor

I have a date in my input files 08-11-12, This date could be August 11. 2012, or (as is the case) November 8. 2012, as I use European date-format.

It looks like Splunk likes to use the American date-format before using the European, so it thinks the event was written in august.

How do I change the default behavior, so that it first uses European format, and then American?

Kind regards

Tags (1)
0 Karma
1 Solution

Contributor

I used the comment from dart.
A little more work, but it works.

View solution in original post

0 Karma

Contributor

I used the comment from dart.
A little more work, but it works.

View solution in original post

0 Karma

Contributor

Thanks - as usual very helpful info.

0 Karma

Splunk Employee
Splunk Employee

It's better to do this with a TIME_FORMAT for each sourcetype, but otherwise you could create your own datetime.xml and then use the default stanza to specify using your copy of datetime.xml.

Legend

These issues are typically found on a per-sourcetype basis, so setting a global default is kind of dangerous. But, if you really know what you are doing you could set a global setting using the [default] stanza in props.conf.

Contributor

Yes, but isn't that on a sourcetype basis. I want to default use the European formats before the American.

0 Karma

Ultra Champion

Check out the TIME_FORMAT parameter for props.conf. With that you specify how the incoming timestamps should be parsed.

0 Karma