Splunk Enterprise

How to extract timestamp without year in log?


I am trying to ingest a new log and unfortunately, it doesn't include year or time zone as part of the message.

The timestamp in the messages is in the following format:


Jun 30 01:02:03 <msg>


I wrote the following props.conf settings to extract the timestamp in the message:


TIME_FORMAT = %b %d %H:%M:%S


 I see the following warnings under splunkd.log:


06-30-2022 14:05:59.555 -0600 WARN  DateParserVerbose [1556614 merging] - The TIME_FORMAT specified is matching timestamps (Tue Jun  6 17:43:20 2023) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=/path/to/log|host=UF01|new_sourcetype|230


 I'm confused where "(Tue Jun 6 17:43:20 2023)" is coming from because none of the logs have this string.

How do I approach this? I've thought about using transforms to write into the DEST_KEY "_time" but I read that any key starting with "_" is not indexed. This data is being received from a syslog server so I thought about modifying the data as it's being received. What are you recommendations?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...