https://community.splunk.com/t5/Getting-Data-In/Original-Timestamp-Value-Format/m-p/497888#M84898 <P>Hello,<BR /> I'm looking for a way to capture the original timestamp value/format from various logs. Here are some of the first x characters of <STRONG>_raw</STRONG> and _time from different logs.</P> <UL> <LI>WinRegistry - <STRONG>01/29/2020 13:57:46.835</STRONG> - 2020-01-29 13:57:46</LI> <LI>access_combined - <STRONG>172.127.127.5 - - [29/Jan/2020:13:57:46 -0500]</STRONG> - 2020-01-29 13:57:46</LI> <LI>apache:error - <STRONG>[Wed Jan 29 13:36:35.220666 2020]</STRONG> - 2020-01-29 13:36:35.220</LI> <LI>Perfmon:Network - <STRONG>01/29/2020 14:00:14.172 -0500</STRONG> - 2020-01-29 14:00:14</LI> <LI>linux:audit - <STRONG>type=PATH msg=audit(1580322995.244:18661773)</STRONG> - 2020-01-29 13:36:35.244</LI> <LI>WinEventLog - <STRONG>01/29/2020 01:39:08 PM</STRONG> - 2020-01-29 13:39:08.000</LI> <LI>WinHostMon - <STRONG>Type=Process <EM>new line</EM> Name="splunk-winhostinfo.exe" <EM>new line</EM> ProcessId=10472 <EM>new line</EM> - CommandLine="C:\Program Files\SplunkUniversalForwarder\bin\splunk-winhostinfo.exe" <EM>new line</EM> StartTime="20200129134140.479764-300"</STRONG> - 2020-01-29 13:41:40.000</LI> <LI>syslog_nohost - <STRONG>Jan 29 13:48:28</STRONG> - 2020-01-29 13:48:28.000</LI> <LI>catalina_server - <STRONG>[29/Jan/2020:13:49:55]</STRONG> - 2020-01-29 13:49:55.000</LI> <LI>Unix:UserAccounts - <STRONG>Wed Jan 29 13:53:50 EST 2020</STRONG> - 2020-01-29 13:53:50.000</LI> </UL> <P>As you can see, in some cases <STRONG>_raw</STRONG> uses millisecond, but <STRONG>_time</STRONG> doesn't; and <EM>vice versa</EM>.</P> <P>Thanks and God bless,<BR /> Genesius</P> Wed, 29 Jan 2020 19:04:32 GMT genesiusj 2020-01-29T19:04:32Z https://community.splunk.com/t5/Getting-Data-In/Original-Timestamp-Value-Format/m-p/497888#M84898 <P>Hello,<BR /> I'm looking for a way to capture the original timestamp value/format from various logs. Here are some of the first x characters of <STRONG>_raw</STRONG> and _time from different logs.</P> <UL> <LI>WinRegistry - <STRONG>01/29/2020 13:57:46.835</STRONG> - 2020-01-29 13:57:46</LI> <LI>access_combined - <STRONG>172.127.127.5 - - [29/Jan/2020:13:57:46 -0500]</STRONG> - 2020-01-29 13:57:46</LI> <LI>apache:error - <STRONG>[Wed Jan 29 13:36:35.220666 2020]</STRONG> - 2020-01-29 13:36:35.220</LI> <LI>Perfmon:Network - <STRONG>01/29/2020 14:00:14.172 -0500</STRONG> - 2020-01-29 14:00:14</LI> <LI>linux:audit - <STRONG>type=PATH msg=audit(1580322995.244:18661773)</STRONG> - 2020-01-29 13:36:35.244</LI> <LI>WinEventLog - <STRONG>01/29/2020 01:39:08 PM</STRONG> - 2020-01-29 13:39:08.000</LI> <LI>WinHostMon - <STRONG>Type=Process <EM>new line</EM> Name="splunk-winhostinfo.exe" <EM>new line</EM> ProcessId=10472 <EM>new line</EM> - CommandLine="C:\Program Files\SplunkUniversalForwarder\bin\splunk-winhostinfo.exe" <EM>new line</EM> StartTime="20200129134140.479764-300"</STRONG> - 2020-01-29 13:41:40.000</LI> <LI>syslog_nohost - <STRONG>Jan 29 13:48:28</STRONG> - 2020-01-29 13:48:28.000</LI> <LI>catalina_server - <STRONG>[29/Jan/2020:13:49:55]</STRONG> - 2020-01-29 13:49:55.000</LI> <LI>Unix:UserAccounts - <STRONG>Wed Jan 29 13:53:50 EST 2020</STRONG> - 2020-01-29 13:53:50.000</LI> </UL> <P>As you can see, in some cases <STRONG>_raw</STRONG> uses millisecond, but <STRONG>_time</STRONG> doesn't; and <EM>vice versa</EM>.</P> <P>Thanks and God bless,<BR /> Genesius</P> Wed, 29 Jan 2020 19:04:32 GMT https://community.splunk.com/t5/Getting-Data-In/Original-Timestamp-Value-Format/m-p/497888#M84898 genesiusj 2020-01-29T19:04:32Z