Getting Data In

How to correct sourcetype that is including events with different timestamp formats

mika703
Engager

Hi guys,

I'm in GMT+2 timezone and having events from sourcetype=tibco.

Based on the event the timestamp format is different:
2019-09-10 12:48:14.066 [blablabla]
OR
2019 Sep 10 12:48:10:263 GMT +0200 [blablabla]

Actually Splunk displays all events with the first timestamp correctly, events with the second timestamp format are displayed as in future for +2 hours (due to the "GMT +0200").

My question is how to correct this issue. I've tried several things in system/local/props.conf without having success. Does sb have an idea?

Thanks in advance and regards
Mika

0 Karma

rupesh26
Path Finder

Hi @mika703

For sourcetypes like these you can use datetime.xml , where you can define multiple time formats

References below
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configuredatetimexml
https://answers.splunk.com/answers/585396/custom-date-format-extraction-using-datetimexml.html

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...