Getting Data In
Highlighted

time format in log4j

Legend

Hi at all,
I have a strange question, strange because it should be easy but it doesn't run!
I have log4j logs with a timesamp

2017-07-26 00:05:21 DEBUG

that is wrongly read by Splunk as

7/26/17 12:05:21 AM

I tried with and without TomeZone.

How can I fix this problem? what I forgot (Holidays are coming 😉 )?

Bye.
Giuseppe

0 Karma
Highlighted

Re: time format in log4j

SplunkTrust
SplunkTrust

What is the expected interpretation of that log4j timestamp? Splunk's interpretation looks right to me.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: time format in log4j

Legend

Probably I have an interpretation problem from the italian way to show hours:
12 AM is followed by 1 AM, 2 AM and so on, correct?
In Italy we have 0 AM, 1 AM, 2AM and so on!
Bye.
Giuseppe

0 Karma
Highlighted

Re: time format in log4j

Legend

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: time format in log4j

Legend

@cusello, I dont think this is an issue with Time Stamp recognition only for log4j logs. By default this is how timestamp for _time would be displayed for any log.

Try changing Splunk URL from US ( http://<YourSplunkServer>/en-US ) to GB ( http://<YourSplunkServer>/en-GB )

See if time is displayed as 00 hours instead of 12




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: time format in log4j

Legend

Yes!
every day I learn!
Thank you.
Bye.
Giuseppe

0 Karma
Highlighted

Re: time format in log4j

Legend

Cheers! Have a nice weekend 🙂




| eval message="Happy Splunking!!!"


0 Karma