- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
uagraw01
Motivator
12-04-2023
08:53 PM
Please help me to get the time format for the below string in props.conf. I am confused with the last three patterns (533+00:00)
2023-12-05T04:21:21,533+00:00
Thanks in advance.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
azteksites
Explorer
12-04-2023
09:22 PM
You can try the following TIME_FORMAT value to parse the timestamp,
TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N%z
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
azteksites
Explorer
12-04-2023
09:22 PM
You can try the following TIME_FORMAT value to parse the timestamp,
TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N%z
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
uagraw01
Motivator
12-04-2023
09:26 PM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
azteksites
Explorer
12-04-2023
09:50 PM
00:00 is an offset from UTC. The %z value should parse this in -/+HHMM format.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SanjayReddy

SplunkTrust
12-04-2023
09:09 PM
Hi @uagraw01
it seems ,533 is milliseconds
2023-12-05T04:21:21,533+00:00
%Y-%m-%dT%H:%S,%3Q+00:00
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
uagraw01
Motivator
12-04-2023
09:15 PM
Thanks for the answer .
By the way have you missed %M ?
should be like this: %Y-%m-%dT%H:%M:%S,%3Q+00:00
