TIME_PREFIX Challenge

[b17gunnr]

Hello folks,

I'm fighting some events in the future and am having some trouble breaking the code for parsing an event. I have the following event (with a little redaction) and have tried some flavors of the the stanza below primarily messing with the TIME_PREFIX to no avail. For every change I make (and a Splunk restart after the fact), Splunk just wants the event in UTC and it is not considering my timezone offset.

Does anyone have any suggestions or thoughts at to why I cannot get Splunk to recognize that time properly? Thank you.

{"id": 141865, "summary": "User's password changed", "remoteAddress": "X.X.X.X", "created": "2025-06-12T14:13:19.323+0000", "category": "user management", "eventSource": "", "objectItem": {"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}, "associatedItems": [{"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}]}

[my_stanza]
TIME_PREFIX = "created": "
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
TZ = UTC

[ITWhisperer · Accepted solution]

Try changing the timezone in your time format

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

("Z" as you have used it is just a character constant - which is used n some date formats)

Time variables 

[gcusello]

Hi @b17gunnr ,

these seem to be json files.

to use a regex, you must see the row data, maybe there are some backslashes in your logs before quotes: check them to be sure about your TIME_PREFIX.

Ciao.

Giuseppe