topic Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config in Splunk Search

ISO 8601 TimeStamp Extraction / Formatting and Source Type Config

DGilbert91 — Wed, 26 Oct 2022 22:44:33 GMT

Hi all,

I have a timestamp in a format I havn't dealt with before and I am struggling to get it converted to my timezone using the offset. In raw event form it is like this:
"TimeGenerated": "2022-10-25T04:21:50.2975103Z"

I have also attached a screenshot of how splunk is indexing it.

My second question is how would I configure the sourcetype to have splunk use TimeGenerated field as _time automatically? I've attached a second screenshot with the sourcetype as well.

Any help or links would be greatly appreciated!

Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config

johnhuang — Thu, 27 Oct 2022 03:10:05 GMT

Try the following settings:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7N%Z
TIME_PREFIX = "TimeGenerated":\s"

Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config

DGilbert91 — Thu, 27 Oct 2022 03:29:28 GMT

hey johnhuang,

I have attempted your suggestion and ingested some more data:

Unfortunately it doesn't look like it has updated _time correctly:

Would these settings have any impact as well?

Appreciate your help, thanks mate

Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config

johnhuang — Thu, 27 Oct 2022 04:11:38 GMT

If the data is being processed by a heavy forwarder, make sure this is applied there.

Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config

DGilbert91 — Wed, 16 Nov 2022 05:33:11 GMT

This worked perfectly thanks mate!