Splunk Search

Splunk not recognizing the date format

oliverkunert
New Member

Splunk is not recognizing the date and time of my data correctly.
My data is in the common log format. An example of a line would be:

192.168.2.1 Logname Username [02/Aug/2002:20:16:59 -0700] "GET /img/pic.jpg HTTP/1.0" 200 56812

Where 02/Aug/2002 would be the date, 20:16:59 the time and -0700 the timezone.
It has a unique sourcetype that is correctly assigned.
When searching for the data the _time field shows incorrect and semi-random values.

My props.conf:

[mysourcetype]
TIME_FORMAT=[%d/%b/%Y:%H:%M:%S %z]
TIME_PREFIX=^

The time format shows the correct regex in Splunk Web under Sourcetypes, so my props.conf gets loaded.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try these props.conf settings.

[mysourcetype]
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
---
If this reply helps you, Karma would be appreciated.

View solution in original post

sbbadri
Motivator

try below,

[mysourcetype]
TIME_FORMAT=\[%d/%b/%Y:%H:%M:%S %z\]
TIME_PREFIX=^\d+\.\d+\.+d\.\d+\s\S+\s\S+\s\[

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It won't work with \[ in both TIME_PREFIX and TIME_FORMAT.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these props.conf settings.

[mysourcetype]
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
---
If this reply helps you, Karma would be appreciated.

oliverkunert
New Member

After I used your configuration the problem still persisted. After removing the date from extracted fields for the search it worked.

0 Karma

adonio
Ultra Champion

try and remove the square brackets around your time format

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...