How to correct sourcetype that is including events with different timestamp formats

[mika703]

Hi guys,

I'm in GMT+2 timezone and having events from sourcetype=tibco.

Based on the event the timestamp format is different:
2019-09-10 12:48:14.066 [blablabla]
OR
2019 Sep 10 12:48:10:263 GMT +0200 [blablabla]

Actually Splunk displays all events with the first timestamp correctly, events with the second timestamp format are displayed as in future for +2 hours (due to the "GMT +0200").

My question is how to correct this issue. I've tried several things in system/local/props.conf without having success. Does sb have an idea?

Thanks in advance and regards
Mika

[rupesh26]

Hi @mika703

For sourcetypes like these you can use datetime.xml , where you can define multiple time formats

References below
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configuredatetimexml
https://answers.splunk.com/answers/585396/custom-date-format-extraction-using-datetimexml.html