Getting Data In

Should Splunk be barking back at this type of time stamp string? 2016/04/07T10:04:02.113[+0000] ? I can't tell if it meets the ISO standard.

dmacgillivray
Communicator

Hello Splunkers,

I have a timestamp below that does not seem to want to get recognized / converted properly by Splunk.

Do I need to have the developers in house adjust their feed? I am assuming this may not be a standard ISO stamp below? I thought it was, but it will not allow us to properly search data within Splunk.

The "Event" stamp below came from GMT and showed up as GMT in the "Time" column and is not converting to EST like we would expect our default login settings and indexers are set to.

Here is the stamp below. Thanks in advance for any help you may be able to provide.

2016/04/07T10:04:02.113[+0000]
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Go back to your developers. ISO 8601 timestamps, which it appears you're trying to use, are in the format YYYY-mm-ddTHH:MM:SS.sss+HHMM.
Note the use of dashes rather than slashes in the date portion. The time offset should not be enclosed in brackets.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Go back to your developers. ISO 8601 timestamps, which it appears you're trying to use, are in the format YYYY-mm-ddTHH:MM:SS.sss+HHMM.
Note the use of dashes rather than slashes in the date portion. The time offset should not be enclosed in brackets.

---
If this reply helps you, Karma would be appreciated.

dmacgillivray
Communicator

Thanks Rich !! I am glad I was onto something. I appreciate your very quick response !!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...