Splunk Search

collect command and time

bowesmana
Champion

I have two Splunk servers and run the following command

| makeresults
| fields - _time
| collect index=temp addtime=f

 

In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC

However, if I do this

 

| makeresults
| collect index=temp addtime=t

 

Then the raw event data looks like this in BOTH servers

10/01/2020 HH:MM:SS .....

i.e. MM/DD/YYYY

but in one server the ingested event is dated 2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.

I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?

 

Labels (1)
Tags (1)
0 Karma

thambisetty
Super Champion

what is  SPlunk versions in both instances?

————————————
If this helps, give a like below.
0 Karma

bowesmana
Champion

Good question - the one parsing correctly is 8.0.1 and the one not is 7.3.4

 

Tags (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.