Splunk Search

Time-Date recognize Unix Epoch Time milliseconds

ryastrebov
Communicator

Hello!
I have log contains time-date in Unix Epoch format (milliseconds).
One event fragments is:

04,013c5f8ecc0f,013c5f8ecd04,0038af,...

Desired date is contained in column 3 (013c5f8ecd04).

During indexing process Splunk some date perceive correctly, and some not. This values (013c5f8ecd04) Splunk understand as 11/28/11 10:53:54.000 PM. It is incorrect.

Necessary to date indexing perceived correctly.
How can this be done?

Best regards,
Roman

Tags (1)
0 Karma

ryastrebov
Communicator

Thanks for the warning! I do not know really how to correctly extract the information about the date and time from the field... Because in most cases the date is retrieved correctly.

0 Karma

sideview
SplunkTrust
SplunkTrust

beware when you do get it working correctly, your date_hour fields and all your date_* fields will be calculated as though you had set the timezone explicitly to GMT, which effectively means all your date_hour values will be off by whatever your timezone offset is, and all your other date_* fields will be slightly unreliable too. This has bitten me in the past.

0 Karma

yannK
Splunk Employee
Splunk Employee

Define a timeprefix and timeformat extraction in props.conf for this sourcetype
To verify use the data preview.

ryastrebov
Communicator

Unlikely because in this file same part of the dates correctly perceived

0 Karma

eashwar
Communicator

i hope it is because of the TIME ZONE configured incorrectly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...