Splunk not recognizing the date format

[oliverkunert]

Splunk is not recognizing the date and time of my data correctly.
My data is in the common log format. An example of a line would be:

192.168.2.1 Logname Username [02/Aug/2002:20:16:59 -0700] "GET /img/pic.jpg HTTP/1.0" 200 56812

Where 02/Aug/2002 would be the date, 20:16:59 the time and -0700 the timezone.
It has a unique sourcetype that is correctly assigned.
When searching for the data the _time field shows incorrect and semi-random values.

My props.conf:

[mysourcetype]
TIME_FORMAT=[%d/%b/%Y:%H:%M:%S %z]
TIME_PREFIX=^

The time format shows the correct regex in Splunk Web under Sourcetypes, so my props.conf gets loaded.

[sbbadri]

try below,

[mysourcetype]
TIME_FORMAT=\[%d/%b/%Y:%H:%M:%S %z\]
TIME_PREFIX=^\d+\.\d+\.+d\.\d+\s\S+\s\S+\s\[

[richgalloway]

It won't work with \[ in both TIME_PREFIX and TIME_FORMAT.

[richgalloway · Accepted solution]

Try these props.conf settings.

[mysourcetype]
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[

[oliverkunert]

After I used your configuration the problem still persisted. After removing the date from extracted fields for the search it worked.

[adonio]

try and remove the square brackets around your time format