Hi at all,
I have a strange question, strange because it should be easy but it doesn't run!
I have log4j logs with a timesamp
2017-07-26 00:05:21 DEBUG
that is wrongly read by Splunk as
7/26/17 12:05:21 AM
I tried with and without TomeZone.
How can I fix this problem? what I forgot (Holidays are coming 😉 )?
Bye.
Giuseppe
@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.
Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US
) to GB ( http://<YourSplunkServer>/en-GB
)
See if time is displayed as 00 hours instead of 12
@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.
Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US
) to GB ( http://<YourSplunkServer>/en-GB
)
See if time is displayed as 00 hours instead of 12
Yes!
every day I learn!
Thank you.
Bye.
Giuseppe
Cheers! Have a nice weekend 🙂
@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.
Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US
) to GB ( http://<YourSplunkServer>/en-GB
)
See if time is displayed as 00 hours instead of 12
What is the expected interpretation of that log4j timestamp? Splunk's interpretation looks right to me.
Probably I have an interpretation problem from the italian way to show hours:
12 AM is followed by 1 AM, 2 AM and so on, correct?
In Italy we have 0 AM, 1 AM, 2AM and so on!
Bye.
Giuseppe