Good day.
I am trying to import a CSV into Splunk and specifying a Timestamp format and it appears Splunk is not calculating the day of year properly.
My data has a column called 'Start Time' with values such as `222/06:00:00` I have specified the timestamp fields as `Start Time` and the Timestamp format as
%j/%H:%M:%S
Splunk correctly identifies the time but it assumes the day/date starts as today (08/15/2016) instead of the specified day of year in the imported data (e.g. 222 is actually 9 Aug. 2016).
I have tested this conversion by editing my CSV so that one of the rows has `001/06:05:04`, which should parse to `01/01/2016 06:05:04.000` but instead parses to `08/15/2016 06:05:04.000`
I've tried this data import on both Splunk Light Free (6.4.0) and Splunk Enterprise (6.4.2) and the results are the same.
Is this a problem with my data or with the way Splunk is parsing the day of year value?
Thanks,
Andy
↧