How to convert a string to date from my log file?

[AyanC]

My log file contains data in the below format. I need to sort the date by the latest one first. Please help as I am unable to convert the string to date format for sorting.

May  4 15:45    

I need to sort the data in latest to oldest format and the date format in the scene is like Jan 15

Please help!!

[woodcock]

Like this:

... | eval Time=strptime(YourStringTimeFieldHere, "%b %d %H:%M") | sort 0 - Time

But the right thing to do, if this is your main timestamp is have Splunk use it for the main timestamp when you index your data. You should only need to do this if this field is some kind of "other" timestamp.

[micahkemp]

Is Splunk not parsing this out correctly at index time? Does your event timestamp not match the string time in the log?