https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446459#M77655 <P>If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information. </P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml">http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml</A></P> <P><A href="https://www.splunk.com/blog/2014/04/23/its-that-time-again.html">https://www.splunk.com/blog/2014/04/23/its-that-time-again.html</A></P> Fri, 07 Sep 2018 17:05:26 GMT sudosplunk 2018-09-07T17:05:26Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446458#M77654 <P>How do you extract a timestamp from message having </P> <P>event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC</P> <P>event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST</P> <P>where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc.</P> Fri, 07 Sep 2018 16:55:44 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446458#M77654 ankithreddy777 2018-09-07T16:55:44Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446459#M77655 <P>If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information. </P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml">http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml</A></P> <P><A href="https://www.splunk.com/blog/2014/04/23/its-that-time-again.html">https://www.splunk.com/blog/2014/04/23/its-that-time-again.html</A></P> Fri, 07 Sep 2018 17:05:26 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446459#M77655 sudosplunk 2018-09-07T17:05:26Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446460#M77656 <P>looks like splunk can handle it,</P> <P>try below props.conf</P> <PRE><CODE>[odd_timestamp] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9N, Timezone:%Z TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=48 </CODE></PRE> <P>worked for me,<BR /> see screenshot below:</P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5721i72CD88BDB2698850/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> Fri, 07 Sep 2018 17:57:04 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-extraction-for-varying-subseconds-and-time-zones/m-p/446460#M77656 adonio 2018-09-07T17:57:04Z