Splunk Search

trying to parse out a timestamp

ytl
Path Finder

i have a log that looks something like this:

terminate_type=VOICE timestamp=11/05 14:43 trunk=A044003

the format is "month/date hour/minute". under the data preview advanced pane to parse the file, i use

# your settings
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT=%m/%d
TIME_PREFIX=timestamp\=
TZ=America/Los_Angeles

and it picks up the month and date fine (11/5/13). however, when i edit the format to try and pick up the time with something like:

TIME_FORMAT=%m/%d %h:%M

it screws up and thinks that the date is now:

5/14/11 2:43:00.000 PM

ie the date, month and year are all screwed up.

any suggestions welcome!

Tags (3)
0 Karma
1 Solution

ShaneNewman
Motivator
TIME_FORMAT=%m/%d %H:%M

Use %H when it is a 24 hour clock, %h is for a 12 hour clock.

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try:

TIME_FORMAT = %m/%d %H:%M

You were using 12hr hour setting, but your log data is in 24hr notation.

--
Jesse Trucks
Minister of Magic

ShaneNewman
Motivator
TIME_FORMAT=%m/%d %H:%M

Use %H when it is a 24 hour clock, %h is for a 12 hour clock.

ShaneNewman
Motivator

Awesome, glad I could help!

0 Karma

ytl
Path Finder

duh! thanks! that worked a treat.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...