hi,
i have some mainframe logs coming into splunk which is in PSV (pipe separated value) format. have managed to parse all of the data successfully, but the date_time
and Event_time
fields are showing dates as 31 dec, 1969 and 1970, but in the log file, it's dated april to june of 2015.
sample log:
IN|15080|830828|V014MSNY|B014MU01|CAL0Q14|DPNT1|PSABTSR1|||0000000|DDTD34|FAIL|10|012||||x980|USER|
You need to tell Splunk how to interpret the timestamp in each event as documented here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Handleeventtimestamps
Just by looking at your event, I have no idea how to interpret your timestamps so I assume Splunk is treating them as epoch
which is giving a time way in the past.