topic Re: How do I deal with inconsistent time formats from Microsoft Azure? in Getting Data In

How do I deal with inconsistent time formats from Microsoft Azure?

danielbb — Wed, 31 Jul 2024 22:17:30 GMT

When ingesting Microsoft Azure data, we see different time formats for different Azure categories, and I wonder how to parse it correctly? Both timezones seem to be UTC. Is the proper approach to set

TZ=UTC

and specify in datetime.xml the two formats?

{ category: NonInteractiveUserSignInLogs time: 2024-07-30T18:02:42.0324621Z . . . } { category: RiskyUsers time: 7/30/2024 1:48:56 PM . . . }

Re: How do I deal with inconsistent time formats from Microsoft Azure?

marnall — Wed, 31 Jul 2024 19:19:22 GMT

Does Splunk parse the time correctly on its own? Try comparing the extracted time of the event with the time in the raw text of the event.

If they are the same and/or adjusted for timezone, then you are good to go.

If they are consistently different with one or more hours between them, then it is likely a timezone issue that can be fixed using props.conf

If they are variably different, then it could be a timestamp extraction issue.