Getting Data In

How to extract time log from JSON data for event _time?

Path Finder

Team,

In my JSON data, there is below line which I want to be my event time (_time).

"eventDateTime" : "2017-24-08T05:19:54.500-05:00",

My props.conf has below entry. I am not sure what to write for last (-05:00). Please help.

TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N
TIME_PREFIX="eventDateTime" :

0 Karma

Super Champion
0 Karma

SplunkTrust
SplunkTrust

HI anantdeshpande,
-05.00 is the timezone, put %z at the end of your TIME_FORMAT

TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N-%z

Check if brackets are in or out of your time field.

Bye.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!