Getting Data In

timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format?

lessthan80
Explorer

the output in splunk console:
3/3/23
2:05:41.000 AM

03/03/2023 02:05:41 p.m. 14664 5046661

Note that the splunk _time is pulling the timestamp from _raw, but not interpreting the "p.m." so splunk is posting the time of the event as 2:05 AM.  I have have tried a few different combinations for the TIME_FORMAT in the props.conf file, and nothing is helping.

here is the current TIME_FORMAT stanza

[###_###_###_#######]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %d/%m/%Y %I:%M:%S
TIME_PREFIX = ^
category = Custom
disabled = false
pulldown_type = true
EXTRACT-total_processing_time = ^[^\t\n]*\t(?P<total_processing_time>\d+\t)
EXTRACT-application_id = ^(?:[^\t\n]*\t){2}(?P<application_id>.+)

current TIME_FORMAT
TIME_FORMAT = %d/%m/%Y %I:%M:%S
I've tried this with %p and %P with no success.   Any ideas?

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Custom datetime.xml is one way you can go. You can also use INGEST-EVAL to adjust your timestamp in post-extraction processing. See the great .conf presentation

https://conf.splunk.com/files/2020/slides/PLA1154C.pdf

There are several examples of dealing with timestamps there.

View solution in original post

lessthan80
Explorer

I started reviewing both answers and they both appear to be correct.   With this information i expect to be able the correct the eventtime problem.   Thanks to both.

richgalloway
SplunkTrust
SplunkTrust

It looks like the dots in "p.m." are getting in the way.  The %p format character expects either "am" or "pm" (in either case) - no dots.

You may be able to parse that timestamp with a custom datetime.xml file.  See https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml#:~:text=The%20Spl....

---
If this reply helps you, Karma would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

Custom datetime.xml is one way you can go. You can also use INGEST-EVAL to adjust your timestamp in post-extraction processing. See the great .conf presentation

https://conf.splunk.com/files/2020/slides/PLA1154C.pdf

There are several examples of dealing with timestamps there.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...