topic Re: Should Splunk be barking back at this type of time stamp string? 2016/04/07T10:04:02.113[+0000] ? I can't tell if it meets the ISO standard. in Getting Data In

Should Splunk be barking back at this type of time stamp string? 2016/04/07T10:04:02.113[+0000] ? I can't tell if it meets the ISO standard.

dmacgillivray — Thu, 07 Apr 2016 14:16:46 GMT

Hello Splunkers,

I have a timestamp below that does not seem to want to get recognized / converted properly by Splunk.

Do I need to have the developers in house adjust their feed? I am assuming this may not be a standard ISO stamp below? I thought it was, but it will not allow us to properly search data within Splunk.

The "Event" stamp below came from GMT and showed up as GMT in the "Time" column and is not converting to EST like we would expect our default login settings and indexers are set to.

Here is the stamp below. Thanks in advance for any help you may be able to provide.

2016/04/07T10:04:02.113[+0000]

Re: Should Splunk be barking back at this type of time stamp string? 2016/04/07T10:04:02.113[+0000] ? I can't tell if it meets the ISO standard.

richgalloway — Thu, 07 Apr 2016 14:35:48 GMT

Go back to your developers. ISO 8601 timestamps, which it appears you're trying to use, are in the format YYYY-mm-ddTHH:MM:SS.sss+HHMM.
Note the use of dashes rather than slashes in the date portion. The time offset should not be enclosed in brackets.

Re: Should Splunk be barking back at this type of time stamp string? 2016/04/07T10:04:02.113[+0000] ? I can't tell if it meets the ISO standard.

dmacgillivray — Thu, 07 Apr 2016 14:38:22 GMT

Thanks Rich !! I am glad I was onto something. I appreciate your very quick response !!