Getting Data In

splunk extract incorrect time

perlish
Communicator

Hi,everyone.

My raw log is like this:
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.110 port:60046 count:6
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.91 port:38026 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:118.43.104.16 port:33967 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:119.1.109.17 port:43973 count:3

And the count of raw log is 409767.
All of the time is 2017/05/22 01:00:01 in raw log.
But splunk extract timestamp is 2017/05/22 01:00:01 2017/05/22 01:00:02 2017/05/22 01:00:03 2017/05/22 01:00:04 2017/05/22 01:00:05
I use this search comand "sourcetype=test |stats count by _time",and got this result.
_time count
2017/05/22 01:00:01 100000
2017/05/22 01:00:02 100000
2017/05/22 01:00:03 100000
2017/05/22 01:00:04 100000
2017/05/22 01:00:05 9767

I have set TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf,but doesn`t work.
I also use this "sourcetype=test | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") "
The timestamp return aN/NaN/NaN NaN:NaN:NaN.000
Anyone know how to solve this issue?
Thanks.

Tags (2)
0 Karma
1 Solution

koshyk
Super Champion

The time format logic should Work. Just tested as below

|makeresults | eval _time="2017-05-22 01:00:01" | eval myEpoch=strptime(_time,"%Y-%m-%d %H:%M:%S")| eval reConvertTime=strftime(myEpoch,"%FT%T")

In your props Try putting and restarting Splunk

TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD=32

View solution in original post

akocak
Contributor

Props you have defined, is it under search or your custom app?

0 Karma

perlish
Communicator

Solved. Thank you so much.

0 Karma

koshyk
Super Champion

The time format logic should Work. Just tested as below

|makeresults | eval _time="2017-05-22 01:00:01" | eval myEpoch=strptime(_time,"%Y-%m-%d %H:%M:%S")| eval reConvertTime=strftime(myEpoch,"%FT%T")

In your props Try putting and restarting Splunk

TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD=32

perlish
Communicator
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...