Getting Data In

How to edit my TIME_FORMAT configuration to get the complete timestamp from my data?

a212830
Champion

Hi,

I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.

Sample line is:

2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377

My props:

ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 40
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z
TIME_PREFIX =^
TZ=US/Eastern

When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter?

Tags (2)
0 Karma

thomrs
Communicator

Try using %z to match the timezone better. %Z is for the timezone name.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...