Getting Data In

How to correct sourcetype that is including events with different timestamp formats


Hi guys,

I'm in GMT+2 timezone and having events from sourcetype=tibco.

Based on the event the timestamp format is different:
2019-09-10 12:48:14.066 [blablabla]
2019 Sep 10 12:48:10:263 GMT +0200 [blablabla]

Actually Splunk displays all events with the first timestamp correctly, events with the second timestamp format are displayed as in future for +2 hours (due to the "GMT +0200").

My question is how to correct this issue. I've tried several things in system/local/props.conf without having success. Does sb have an idea?

Thanks in advance and regards

0 Karma

Path Finder

Hi @mika703

For sourcetypes like these you can use datetime.xml , where you can define multiple time formats

References below

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...