How to get proper _time extraction for 2 different date formats in a single sourcetype?

[garryclarke]

I have a SPLUNK 6.2 instance ingesting data with the following 2 date formats using a single sourcetype.

01/12/14,14:30:11,00:00:00:00,83,00,00000,0404,02920881500,07088830091
30:11:2014,19:45:30,00:00:05:45,84,21,00010,0225,00006323653,00066388663

In both cases SPLUNK is able to correctly extract all fields from the comma delimited row and correctly identify them as events.
However in the case of the first line of data SPLUNK is able to extract the date and time of 01/12/2014 @ 14:30:11 and store it as the time against the event.
However for the second record SPLUNK is not assigning the correct data and time and is using a date and time of 01/12/2014 @ 19:45:30
It would seem that it is not able to correctly identify the date correctly when it is delimited with : characters.

The only additional configuration I have carried out is adding the following
TIME_PREFIX = ^
Could anyone point me in the direction of where I need to look in order to fix this?

[gfuente · Accepted solution]

Hello

You need to create a custom datetime.xml, you can follow this tutorial to get it:

http://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem/

Regards

[garryclarke]

Although I like the solution you detailed above gfuente, it will be useful in the future, I went back to source and ensured that the sending system was sending me data in the same format for all records.