Having difficulties with a date/time conversion?

NanSplk01 — Tue, 28 Mar 2023 01:03:50 GMT

I have been trying to create this sourcetype and am not sure I'm capturing it correctly.

Sample date: [2023-03-26T14:06:06.356-04:00]

Regex Breakdown: \[\d{4}-\d{2}-\d{2}.\d{2}:\d{2}:\d{2}.\d{3}-\d{2}:\d{2}]

Timestamp: %Y-%m-%d{2}\T\d{2}:%H%:%M.%S.%N-\d{2}:\d{2}

But I'm having issues with the timestamp value. I've not run into one that has no breaks in it before. Any help will be much appreciated.

Re: Having difficulties with a date/time conversion

yeahnah — Mon, 27 Mar 2023 23:47:54 GMT

Hi @NanSplk01

The regex looks OK, but time format variables used are wrong. Here's the Splunk doc ref

This should work for you

Timestamp: %Y-%m-%dT%H:%M:%S.%3N%z

Hope that helps