Checkpoint Firewall Log Timestamps

[cfairbairn]

I'm running Splunk Light 7.1.3 on a Windows 2012 R2 server. I have some text logs from Checkpoint firewalls - unfortunately I don't have direct access to the firewall appliances themselves.

An example of line data that I'm working with is:

"" "5Sep2018" "23:58:59" "" "" "Log" "Drop" "<#>" "" "" "" "" "" "" "" "" "" "t" "" ""

I'm using the WebGUI data import tool to import the text files. I can't seem to get Splunk to recognise the timestamps.

I've used the following timestamp format:

%e%b%Y %k:%M:%S

And a couple of different variations (%d, %H) etc. No luck.

I get the error "Could not use strptime to parse timestamp..."

Any idea on what I'm doing wrong?

[HiroshiSatoh]

I got it in this format.

%d%b%Y %H:%M:%S

[cfairbairn]

Thanks. I have tried that time format also without luck.