Getting Data In

How to edit my TIME_FORMAT configuration to get the complete timestamp from my data?

a212830
Champion

Hi,

I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.

Sample line is:

2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377

My props:

ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 40
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z
TIME_PREFIX =^
TZ=US/Eastern

When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter?

Tags (2)
0 Karma

thomrs
Communicator

Try using %z to match the timezone better. %Z is for the timezone name.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...