topic Need Time_Format value in Getting Data In

Need Time_Format value

VijaySrrie — Wed, 24 Jun 2020 08:04:55 GMT

Hi, I have two different time values 2020-06-24 03:07:39,997Z 2020-06-24 03:07:39.990Z The first value has a comma(,) and the second value has a dot(.) How can I parse both the values. Any documentation on this?

Re: Need Time_Format value

kamlesh_vaghela — Wed, 24 Jun 2020 08:28:41 GMT

@VijaySrrie

You can go through this link.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Commontimeformatvariables

Please check my sample search with your provided data.

Hope this will help you.

Thanks
Kamlesh Vaghela

Re: Need Time_Format value

gcusello — Wed, 24 Jun 2020 09:23:31 GMT

Hi @VijaySrrie ,

you can leave Splunk to use the correct Time format without forcing a TIME_FORMAT in props.conf.

If Splunk doesn't know one of them add it to datetime.xml following the instructions at https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/Data/Configuredatetimexml

Ciao.

Giuseppe

Re: Need Time_Format value

gcusello — Fri, 03 Jul 2020 06:36:57 GMT

Hi @VijaySrrie ,

Perfect!

If you appreciate this solution you can also leave a Karma Point .

Ciao and next time.

Giuseppe