timestamp for csv

[friskyapple]

I'm just starting out with splunk and have a few CSVs that i'm trying to import. the main one contains library records from the past decade. It originally contained both in and out time, but i've broken it down to be as simple as possible to start with and given it just the initial check out time. The times are all written in the same manner. There's about 134000 entries total. 

game_id,attendee_id,event_id,check_out_time
328,7199,5,2010-09-05 01:32:57
228,7241,5,2010-09-05 01:33:13
379,7327,5,2010-09-05 01:33:51
96,6729,5,2010-09-05 01:34:37

when i go to import this data , the timestamp is always wrong:

 I've read through numerous forum posts on splunk and other websites and had multiple people double check the csv; I cannot identify why it struggles to pull the correct timestamp for these events. 

Any help will be greatly appreciated. 

[to4kawa]

2010-09-05 01:32:57

%Y-%m-%d %T

not %y

but you don't need time settings. 

splunk can extract time automatically.

[bowesmana · Accepted solution]

@friskyapple 

You should use capital Y for 4 digit years. Your lower case y is a two digit year.

However, that timestamp is ISO8601 so I would expect it to extract it automatically

You also need to add the MAX_DAYS_AGO setting to allow it to pick up dates in 2010 as by default it will only go back 2000 days. See that setting here

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Propsconf

[friskyapple]

holy cow it worked, thank you!! I cannot express my thanks enough.