topic How to extract time log from JSON data for event _time? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337664#M62350 <P>Team,</P> <P>In my JSON data, there is below line which I want to be my event time (_time). </P> <P>"eventDateTime" : "2017-24-08T05:19:54.500-05:00",</P> <P>My props.conf has below entry. I am not sure what to write for last (-05:00). Please help.</P> <P>TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N<BR /> TIME_PREFIX="eventDateTime" :</P> Tue, 29 Sep 2020 16:30:59 GMT anantdeshpande 2020-09-29T16:30:59Z How to extract time log from JSON data for event _time? https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337664#M62350 <P>Team,</P> <P>In my JSON data, there is below line which I want to be my event time (_time). </P> <P>"eventDateTime" : "2017-24-08T05:19:54.500-05:00",</P> <P>My props.conf has below entry. I am not sure what to write for last (-05:00). Please help.</P> <P>TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N<BR /> TIME_PREFIX="eventDateTime" :</P> Tue, 29 Sep 2020 16:30:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337664#M62350 anantdeshpande 2020-09-29T16:30:59Z Re: How to extract time log from JSON data for event _time? https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337665#M62351 <P>HI anantdeshpande,<BR /> -05.00 is the timezone, put %z at the end of your TIME_FORMAT</P> <PRE><CODE>TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N-%z </CODE></PRE> <P>Check if brackets are in or out of your time field.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 30 Oct 2017 12:04:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337665#M62351 gcusello 2017-10-30T12:04:41Z Re: How to extract time log from JSON data for event _time? https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337666#M62352 <PRE><CODE>%Y-%d-%mT%H:%M:%S%3N%:z </CODE></PRE> <P>try that. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables</A></P> Mon, 30 Oct 2017 12:05:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-time-log-from-JSON-data-for-event-time/m-p/337666#M62352 cmerriman 2017-10-30T12:05:17Z