I'm running Splunk Light 7.1.3 on a Windows 2012 R2 server. I have some text logs from Checkpoint firewalls - unfortunately I don't have direct access to the firewall appliances themselves.
An example of line data that I'm working with is:
"" "5Sep2018" "23:58:59" "" "" "Log" "Drop" "<#>" "" "" "" "" "" "" "" "" "" "t" "" ""
I'm using the WebGUI data import tool to import the text files. I can't seem to get Splunk to recognise the timestamps.
I've used the following timestamp format:
%e%b%Y %k:%M:%S
And a couple of different variations (%d, %H) etc. No luck.
I get the error "Could not use strptime to parse timestamp..."
Any idea on what I'm doing wrong?
I got it in this format.
%d%b%Y %H:%M:%S
Thanks. I have tried that time format also without luck.