splunk extract incorrect time

[perlish]

Hi,everyone.

My raw log is like this:
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.110 port:60046 count:6
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.91 port:38026 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:118.43.104.16 port:33967 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:119.1.109.17 port:43973 count:3

And the count of raw log is 409767.
All of the time is 2017/05/22 01:00:01 in raw log.
But splunk extract timestamp is 2017/05/22 01:00:01 2017/05/22 01:00:02 2017/05/22 01:00:03 2017/05/22 01:00:04 2017/05/22 01:00:05
I use this search comand "sourcetype=test |stats count by _time",and got this result.
_time count
2017/05/22 01:00:01 100000
2017/05/22 01:00:02 100000
2017/05/22 01:00:03 100000
2017/05/22 01:00:04 100000
2017/05/22 01:00:05 9767

I have set TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf,but doesn`t work.
I also use this "sourcetype=test | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") "
The timestamp return aN/NaN/NaN NaN:NaN:NaN.000
Anyone know how to solve this issue?
Thanks.

[akocak]

Props you have defined, is it under search or your custom app?

[somesoni2]

See this

https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-sec...

[perlish]

Solved. Thank you so much.

[koshyk · Accepted solution]

The time format logic should Work. Just tested as below

|makeresults | eval _time="2017-05-22 01:00:01" | eval myEpoch=strptime(_time,"%Y-%m-%d %H:%M:%S")| eval reConvertTime=strftime(myEpoch,"%FT%T")

In your props Try putting and restarting Splunk

TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD=32

[perlish]

Still doesn`t work, it should be splunk limit.
https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-sec...