How do I deal with inconsistent time formats from Microsoft Azure?

[danielbb]

When ingesting Microsoft Azure data, we see different time formats for different Azure categories, and I wonder how to parse it correctly? Both timezones seem to be UTC. Is the proper approach to set 

TZ=UTC

and specify in datetime.xml the two formats?

{ 
   category: NonInteractiveUserSignInLogs
   time: 2024-07-30T18:02:42.0324621Z

. . .

}

{

   category: RiskyUsers
   time: 7/30/2024 1:48:56 PM

. . .

}

[marnall]

Does Splunk parse the time correctly on its own? Try comparing the extracted time of the event with the time in the raw text of the event.

If they are the same and/or adjusted for timezone, then you are good to go.

If they are consistently different with one or more hours between them, then it is likely a timezone issue that can be fixed using props.conf

If they are variably different, then it could be a timestamp extraction issue.