Hi guys,
I'm in GMT+2 timezone and having events from sourcetype=tibco.
Based on the event the timestamp format is different:
2019-09-10 12:48:14.066 [blablabla]
OR
2019 Sep 10 12:48:10:263 GMT +0200 [blablabla]
Actually Splunk displays all events with the first timestamp correctly, events with the second timestamp format are displayed as in future for +2 hours (due to the "GMT +0200").
My question is how to correct this issue. I've tried several things in system/local/props.conf without having success. Does sb have an idea?
Thanks in advance and regards
Mika
Hi @mika703
For sourcetypes like these you can use datetime.xml , where you can define multiple time formats
References below
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configuredatetimexml
https://answers.splunk.com/answers/585396/custom-date-format-extraction-using-datetimexml.html