Solved: How to get date and time from this format? - Splunk Community

Getting Data In

I have date and time in this format,

[2010/01/14@08:43:17.561+0100]

How to read it correctly into Splunk?

1 Solution

Solution

Give this a try (props.conf on your indexer/heavy forwarder)

[yoursourcetype]
 ....other line breaking stuffs...
 TIME_PREFIX = \[
 TIME_FORMAT = %Y/%m/%d@%H:%M:%S.%3N%z
 MAX_TIMESTAMP_LOOKAHEAD = 28

View solution in original post

Solution

Give this a try (props.conf on your indexer/heavy forwarder)

[yoursourcetype]
 ....other line breaking stuffs...
 TIME_PREFIX = \[
 TIME_FORMAT = %Y/%m/%d@%H:%M:%S.%3N%z
 MAX_TIMESTAMP_LOOKAHEAD = 28

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...