https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328025#M60900 <P>Interesting - according to <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables">Date and time format variables</A></P> <P>we can replace <CODE>%Y-%m-%d</CODE> with <CODE>%F</CODE>.</P> Sun, 04 Mar 2018 00:37:53 GMT ddrillic 2018-03-04T00:37:53Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328021#M60896 <P>One of our teams wishes to use ISO 8601 for their log event timestamps. They have the desire to use any of the formats provided in that standard. Does Splunk 6.4.1 support timestamp recognition configuration for this?</P> <P>The logs currently use this variation: 2018-03-02T17:02:09.335Z</P> <P>What is the recommended way to configure timestamp recognition for the above sample?</P> Fri, 02 Mar 2018 17:23:34 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328021#M60896 crisjnelson 2018-03-02T17:23:34Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328022#M60897 <P>I believe that time format is supported by default. However, it's a best practice to always put <CODE>TIME_FORMAT</CODE> in your props.conf files to tell Splunk what time format is used by each sourcetype. This keeps Splunk from guessing wrong and actually improves indexing performance.<BR /> In your case, use <CODE>TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z</CODE>.</P> Fri, 02 Mar 2018 18:38:47 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328022#M60897 richgalloway 2018-03-02T18:38:47Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328023#M60898 <P>Much appreciated! I am doing this, and assume Splunk is using UTC as the time zone. Now, search results appear in the future. I have to select all time to get the latest events. My Indexers are running in CST and my Search Heads are running in PST. _time shows as something else. What do I need to configure in order for my searches to be relative to the current time?</P> Fri, 02 Mar 2018 18:50:06 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328023#M60898 crisjnelson 2018-03-02T18:50:06Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328024#M60899 <P>If you set the time zone in your profile to CST do events still appear in the future?</P> <P>Many admins prefer to run all of their Splunk servers in UTC (or some other common time zone) to avoid problems and confusion.</P> Sat, 03 Mar 2018 21:40:10 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328024#M60899 richgalloway 2018-03-03T21:40:10Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328025#M60900 <P>Interesting - according to <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables">Date and time format variables</A></P> <P>we can replace <CODE>%Y-%m-%d</CODE> with <CODE>%F</CODE>.</P> Sun, 04 Mar 2018 00:37:53 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328025#M60900 ddrillic 2018-03-04T00:37:53Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328026#M60901 <P>What time zone are you in, and what time zone is set in your GUI for Splunk. Additionally you can set the timezone in the props on your host and help alleviate this kind of issue.</P> Sun, 04 Mar 2018 06:42:45 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-method-of-configuring-timestamp-recognition-to/m-p/328026#M60901 esix_splunk 2018-03-04T06:42:45Z