time format in log4j

[gcusello]

Hi at all,
I have a strange question, strange because it should be easy but it doesn't run!
I have log4j logs with a timesamp

2017-07-26 00:05:21 DEBUG

that is wrongly read by Splunk as

7/26/17 12:05:21 AM

I tried with and without TomeZone.

How can I fix this problem? what I forgot (Holidays are coming 😉 )?

Bye.
Giuseppe

[niketn]

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

[gcusello]

Yes!
every day I learn!
Thank you.
Bye.
Giuseppe

[niketn]

Cheers! Have a nice weekend 🙂

[niketn · Accepted solution]

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

[richgalloway]

What is the expected interpretation of that log4j timestamp? Splunk's interpretation looks right to me.

[gcusello]

Probably I have an interpretation problem from the italian way to show hours:
12 AM is followed by 1 AM, 2 AM and so on, correct?
In Italy we have 0 AM, 1 AM, 2AM and so on!
Bye.
Giuseppe