Hello
I'm getting logs from my customer and the timestamp there is day and month without year.
that case causes splunk to index the events with future dates
example:
12/31/20 11:59:59.000 PM Dec 31 23:59:59 csm kerne
how can i modify the date before indexing so i will see the correct timestamp ?
thanks
DATETIME_CONFIG = none
at props.conf, and EXTRACT
timestamp field and TRANSFORMS
make appropriate timestamp by INGEST_EVAL
Hello @sarit_s ,
actually 12/31/20 looks like a date (31 Dec 2020), just wrong one. I'd try to solve it on the log source side if possible.
Hey
thanks for your answer
i cannot do anything with the source since it is third party costumer and he will not do any changes in the logs..
the year is the only wrong part
the link you sent me is not relevant since i don't have any part of the year and there it is pointing of situations with two digits of the year
there is no timestamp configuration in the sourcetype so i guess it is the default
thanks