topic How to edit my TIME_FORMAT configuration to get the complete timestamp from my data? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-TIME-FORMAT-configuration-to-get-the-complete/m-p/128532#M26379 <P>Hi,</P> <P>I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.</P> <P>Sample line is:</P> <PRE><CODE>2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377 </CODE></PRE> <P>My props:</P> <PRE><CODE>ANNOTATE_PUNCT = false KV_MODE = AUTO LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 40 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z TIME_PREFIX =^ TZ=US/Eastern </CODE></PRE> <P>When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter? </P> Fri, 06 Feb 2015 02:22:07 GMT a212830 2015-02-06T02:22:07Z How to edit my TIME_FORMAT configuration to get the complete timestamp from my data? https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-TIME-FORMAT-configuration-to-get-the-complete/m-p/128532#M26379 <P>Hi,</P> <P>I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.</P> <P>Sample line is:</P> <PRE><CODE>2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377 </CODE></PRE> <P>My props:</P> <PRE><CODE>ANNOTATE_PUNCT = false KV_MODE = AUTO LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 40 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z TIME_PREFIX =^ TZ=US/Eastern </CODE></PRE> <P>When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter? </P> Fri, 06 Feb 2015 02:22:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-TIME-FORMAT-configuration-to-get-the-complete/m-p/128532#M26379 a212830 2015-02-06T02:22:07Z Re: How to edit my TIME_FORMAT configuration to get the complete timestamp from my data? https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-TIME-FORMAT-configuration-to-get-the-complete/m-p/128533#M26380 <P>Try using %z to match the timezone better. %Z is for the timezone name.</P> Fri, 06 Feb 2015 03:18:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-TIME-FORMAT-configuration-to-get-the-complete/m-p/128533#M26380 thomrs 2015-02-06T03:18:36Z