Getting Data In

time format in log4j

Legend

Hi at all,
I have a strange question, strange because it should be easy but it doesn't run!
I have log4j logs with a timesamp

2017-07-26 00:05:21 DEBUG

that is wrongly read by Splunk as

7/26/17 12:05:21 AM

I tried with and without TomeZone.

How can I fix this problem? what I forgot (Holidays are coming 😉 )?

Bye.
Giuseppe

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Legend

Yes!
every day I learn!
Thank you.
Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

Cheers! Have a nice weekend 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

What is the expected interpretation of that log4j timestamp? Splunk's interpretation looks right to me.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Legend

Probably I have an interpretation problem from the italian way to show hours:
12 AM is followed by 1 AM, 2 AM and so on, correct?
In Italy we have 0 AM, 1 AM, 2AM and so on!
Bye.
Giuseppe

0 Karma