Alerting

Time format

uagraw01
Builder

Please help me to get the time format for the below string in props.conf. I am confused with the last three patterns (533+00:00)

 

2023-12-05T04:21:21,533+00:00

 

Thanks in advance.

Labels (1)
0 Karma
1 Solution

azteksites
Explorer

You can try the following TIME_FORMAT value to parse the timestamp,

TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N%z

 

View solution in original post

0 Karma

azteksites
Explorer

You can try the following TIME_FORMAT value to parse the timestamp,

TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N%z

 

0 Karma

uagraw01
Builder

@azteksites 

I am still confused for 00:00 (for last two pattern )

uagraw01_0-1701753929561.png

 

0 Karma

azteksites
Explorer

@uagraw01 

00:00 is an offset from UTC. The %z value should parse this in -/+HHMM format.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @uagraw01 

it seems ,533 is milliseconds

2023-12-05T04:21:21,533+00:00

%Y-%m-%dT%H:%S,%3Q+00:00

0 Karma

uagraw01
Builder

Thanks for the answer .

By the way have you missed %M ?

 

should be like this: %Y-%m-%dT%H:%M:%S,%3Q+00:00

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...