Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Timestamp has correct time, incorrect date for some events

$
0
0

I am adding data from a log file with filename: C:\init97\log\mpinet_init97-20120414-000004.mlg

For the timestamp, some events have the correct timestamp of 4/14/12 + the event time in the log file. Other events, however, have an incorrect timestamp with a date that is in the future. For example, 4/17/12 + event time from log.

The event time always seems to be correct. It is the date that is correct for some, incorrect for others, within the same file.

An example of an event with a correct timestamp is: 00:50:13 [02535] WARN javax.management.remote.generic: JMX connector transport got exception when reading input message: java.net.SocketException: Connection reset ... This gets a timestamp of 4/14/12 12:50:13.000 AM

An example of an event with an incorrect timestamp is: 13:43:56 [00171] ERROR atesystems.hub.logging.NativeLog: MAD_DbxDisconnect: MAD_OdbcFreeEnv() failed, ignored. ... This gets a timestamp of 4/17/12 1:43:56.000 PM

I tried creating a custom datetime.xml, but it didnt fix the issue. It is using only the following datetime definition:

<define name="_combdatetime3" extract="year, month, day, hour, minute, second"> <text><![CDATA[(?<![\d\.])(20\d\d)(0\d|1[012])([012]\d|3[01])[.-]?([01]\d|2[0123])([0-6]\d)([0-6]\d)]]></text> </define>

I also tried setting the timezone as TZ = US/Central. This too did not fix the issue.

Can anyone help?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>