Getting Data In

How to parse the date_time and event_time fields from my raw data in PSV format?

shivarpith
Path Finder

hi,

i have some mainframe logs coming into splunk which is in PSV (pipe separated value) format. have managed to parse all of the data successfully, but the date_time and Event_time fields are showing dates as 31 dec, 1969 and 1970, but in the log file, it's dated april to june of 2015.

sample log:

IN|15080|830828|V014MSNY|B014MU01|CAL0Q14|DPNT1|PSABTSR1|||0000000|DDTD34|FAIL|10|012||||x980|USER|
0 Karma

woodcock
Esteemed Legend

You need to tell Splunk how to interpret the timestamp in each event as documented here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps

Just by looking at your event, I have no idea how to interpret your timestamps so I assume Splunk is treating them as epoch which is giving a time way in the past.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...