Getting Data In

Time config incorrect

_joe
Contributor

This isn't so much a question as a comment. I found that time config to be incorrect. 

My logs start like this:
{"Time": "29 Jan 2025 03:16:30, PST",

The default timestring is expecting a 2 digit year.

 

%d %b %y %H:%M:%S, %Z

 

Prior to the update, Splunk was stil able to figure out the time but issed the timezone parameter. In other words, if your heavy forwarder has the same timezone as your zScaler logs you would probably be fine.

 

 

Labels (1)
0 Karma
1 Solution

_joe
Contributor

I updated it to a 4 digit year to match my logs. 

%d %b %Y %H:%M:%S, %Z

 

View solution in original post

0 Karma

_joe
Contributor

I updated it to a 4 digit year to match my logs. 

%d %b %Y %H:%M:%S, %Z

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...