Getting Data In

Time format is not working as per props.conf file

ajitshukla61116
Path Finder

I want to ingest data at current time ,for that we are using props.conf file ,the configuration for which is

props.conf
DATETIME_CONFIG =CURRENT
TIME_FORMAT =%Y-%m-%d %H:%M:%S

I am getting current time properly but TIME FORMAT is not working.

I don't know what is the issue ,please help me to resolve this issue.

0 Karma

woodcock
Esteemed Legend

The TIME_FORMAT setting is for when you parse event characters to pull out timestamps, which you are NOT doing so it is not used.

There is only 1 way to change how timestamps appear generally, that is to use a different localization which is part of your URL. Most of the time this is en-US but try en-GB for example, to see how it changes. In any case, you have FULL CONTROL of this on a search-by-search basis. Just add this to the bottom/middle of any search:

... | fieldformat _time=strftime(_time, "%Y-%m-%d %H:%M:%S")
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @ajitshukla,
Timestamp in Splunk stored in epoch format (interger) not in any string format so here TIME_FORMAT will not be used as you have added DATETIME_CONFIG to CURRENT.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

TIME_FORMAT applies to parsing timestamp strings in events. You are not parsing timestamps.

If you want to change how timestamps are presented to users, try the strftime function. For example, ... | eval time=strftime(_time, "%Y-%m-%d %H:%M:%S") | table time ....

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...