Splunk Search

collect command and time

bowesmana
SplunkTrust
SplunkTrust

I have two Splunk servers and run the following command

| makeresults
| fields - _time
| collect index=temp addtime=f

 

In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC

However, if I do this

 

| makeresults
| collect index=temp addtime=t

 

Then the raw event data looks like this in BOTH servers

10/01/2020 HH:MM:SS .....

i.e. MM/DD/YYYY

but in one server the ingested event is dated 2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.

I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?

 

Labels (1)
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

what is  SPlunk versions in both instances?

————————————
If this helps, give a like below.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Good question - the one parsing correctly is 8.0.1 and the one not is 7.3.4

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...