topic Re: timestamp question in Getting Data In

timestamp question

a212830 — Mon, 17 Mar 2014 14:10:52 GMT

hI,

Setting up a syslog feed and run into something that I haven't yet:

2014-03-17T02:02:26-04:00

What does the T stand for? The time is one hour behind the current timestamp, so I'm assuming that it's a timezone?

Re: timestamp question

starcher — Mon, 17 Mar 2014 14:35:14 GMT

T stands for time. the timezone adjustment is the -4:00 at the end.

Re: timestamp question

a212830 — Mon, 17 Mar 2014 14:47:26 GMT

So, how would I configure that in props.conf?

Re: timestamp question

starcher — Mon, 17 Mar 2014 14:53:11 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?r=splunky
If Splunk is not auto detecting the timezone, you can force the timezone for a sourcetype as shown in the props documentation linked above; look for TZ =

Re: timestamp question

a212830 — Mon, 17 Mar 2014 15:32:38 GMT

Thanks. I looked at the doc, but I'm still unclear. How would you reference the T? Or would you reference the -4:00?

Re: timestamp question

somesoni2 — Mon, 17 Mar 2014 16:15:03 GMT

Splunk can process this format without any props.conf configuration.

Re: timestamp question

a212830 — Mon, 28 Sep 2020 16:09:44 GMT

Don't want to do it without props - trying to follow the recommended guidelines - configuring time_zone, time_format....

Here's what I have:

[acme_syslog]
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = 1
TIME_FORMAT = %y-%m-%dT%H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)
TZ = US/Central