Getting Data In

Time format for 2016-25-11T00:00:0019:47:00

Thuan
Explorer

Hi
the string "2016-25-11T00:00:0019:47:00" represents the time stamp in a logfile. I can figure that
2016-25-11 is %Y-%m-%d in strptime format
T represents the start of the time section
but what is the remaining string " T00:00:0019:47:00" in terms of strptime => T%H:%M: and what else?
Can you explain what is 0019:47:00? What is the format used here in terms of seconds, milliseconds, etc.
I need to extract the time stamp. Thank you.

0 Karma

DalJeanis
Legend

This is almost certain to be caused by some prior process misunderstanding the data that it was transforming, and putting the mm and dd in the wrong place.

Literally NO ONE uses yyyy-dd-mm, so it has to be a mistake.

Better to go back and get the prior translation process corrected to put out valid yyyy-mm-dd format.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Thuan,
at first %Y-%m-%d isn't correct (month and day are reversed!), every way, I don't know the meaning of your log but I think that your format could be:

%Y-%d-%mT00:00:00%H:%M:%S

Bye.
Giuseppe

0 Karma

horsefez
Motivator

Hi Thuan,

could it be that these are two timestamps joined together in a wierd way?
Like 00:00:00 and 19:47:00, just without a space between them.

What application is this log from?
Maybe the application doesn't utilize those fields for whatever reason.

Could you show us examples from the logs where the sequence "00:00:00" after "T" isn't all zeros?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...