topic setting the time format for timezone offset in props in Splunk Search https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320357#M95744 <P>hi,</P> <P>I would like extract the timezone offset in time format in props.<BR /> example time format , 2017-02-05T01:20:10.049-0500: 0.855:<BR /><BR /> TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N-%Z</P> <P>But the above timeformat which i defined is not working. I want my timestamp in splunk to have upto 2017-02-05T01:20:10.049-0500 ignoring 0.855</P> Mon, 20 Feb 2017 19:33:07 GMT kteng2024 2017-02-20T19:33:07Z setting the time format for timezone offset in props https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320357#M95744 <P>hi,</P> <P>I would like extract the timezone offset in time format in props.<BR /> example time format , 2017-02-05T01:20:10.049-0500: 0.855:<BR /><BR /> TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N-%Z</P> <P>But the above timeformat which i defined is not working. I want my timestamp in splunk to have upto 2017-02-05T01:20:10.049-0500 ignoring 0.855</P> Mon, 20 Feb 2017 19:33:07 GMT https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320357#M95744 kteng2024 2017-02-20T19:33:07Z Re: setting the time format for timezone offset in props https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320358#M95745 <P>%Y-%m-%dT%H:%M:%S.%3N%Z</P> Mon, 20 Feb 2017 19:36:39 GMT https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320358#M95745 bshuler_splunk 2017-02-20T19:36:39Z Re: setting the time format for timezone offset in props https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320359#M95746 <P>thank you for reply but it is not working.</P> Mon, 20 Feb 2017 20:29:40 GMT https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320359#M95746 kteng2024 2017-02-20T20:29:40Z Re: setting the time format for timezone offset in props https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320360#M95747 <P>This needs to be deployed to your indexers and splunkd restarted there and even then only events that are indexed post-restart will show the effects of the new configurations.</P> Mon, 20 Feb 2017 21:15:22 GMT https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320360#M95747 woodcock 2017-02-20T21:15:22Z Re: setting the time format for timezone offset in props https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320361#M95748 <P>I see that this is accepted; so is it working now?</P> Mon, 27 Feb 2017 15:00:36 GMT https://community.splunk.com/t5/Splunk-Search/setting-the-time-format-for-timezone-offset-in-props/m-p/320361#M95748 woodcock 2017-02-27T15:00:36Z