Log entries have timestamps with Taiwan years. Taiwan year = current year-1911, so this year is 99. By default Splunk sees the time as the year 1999 and shows old data
Is this something I can use datetime.xml for? Maybe an offset?
asked 13 Apr '10, 07:24
I don't know of a way to have it read that. Splunk uses strptime, plus a few additions (like %Z, %3N, and I think it might be able to pick up hexadecimal epoch time) but I am not aware of a way to offset dates or times at index time.
answered 13 Apr '10, 14:03