Splunk Search

trying to parse out a timestamp

ytl
Path Finder

i have a log that looks something like this:

terminate_type=VOICE timestamp=11/05 14:43 trunk=A044003

the format is "month/date hour/minute". under the data preview advanced pane to parse the file, i use

# your settings
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT=%m/%d
TIME_PREFIX=timestamp\=
TZ=America/Los_Angeles

and it picks up the month and date fine (11/5/13). however, when i edit the format to try and pick up the time with something like:

TIME_FORMAT=%m/%d %h:%M

it screws up and thinks that the date is now:

5/14/11 2:43:00.000 PM

ie the date, month and year are all screwed up.

any suggestions welcome!

Tags (3)
0 Karma
1 Solution

ShaneNewman
Motivator
TIME_FORMAT=%m/%d %H:%M

Use %H when it is a 24 hour clock, %h is for a 12 hour clock.

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try:

TIME_FORMAT = %m/%d %H:%M

You were using 12hr hour setting, but your log data is in 24hr notation.

--
Jesse Trucks
Minister of Magic

ShaneNewman
Motivator
TIME_FORMAT=%m/%d %H:%M

Use %H when it is a 24 hour clock, %h is for a 12 hour clock.

ShaneNewman
Motivator

Awesome, glad I could help!

0 Karma

ytl
Path Finder

duh! thanks! that worked a treat.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...