Why is TIME_FORMAT not working?

himanshu1 — Tue, 07 Mar 2023 21:54:43 GMT

Hello Friends,

In a sourcetype , data are coming in from multiple hosts and host are residing in diff-2 time zones.

In raw logs we can see time zone is also mentioned, I want to write a generic TIME_FORMAT for this.

time stamps example :

Mar 7 09:18:00 SGT:
Mar 6 19:07:42 UTC:
Mar 7 01:31:58.460 WST:
Mar 7 09:13:17.384:

I tried like TIME_FORMAT= %b %d %H:%M:%S.%Q %Z , WHICH IS NOT WORKING.

%Z is not able to recognize time zone here , please help me with some other expression.

Thanks in advance 🙂

Happy Splunking ! !

Re: TIME_FORMAT not working

PickleRick — Tue, 07 Mar 2023 20:24:50 GMT

You can't have a single TIME_FORMAT for two different time specs.

You could try to extract a "base timestamp" from the event then offsetting it with data from timezone by INGEST_EVAL