Time format throwing error

[saifuddin9122]

Hello All,

i have a sourcetype with timestamp as "2017-10-10T18:55:47.425Z" and i defined TIME_FORMAT as "%Y-%m-%dT%H:%M:%S.%3%Z" but seems to be issue am getting the following error

Bad strptime format value: '%Y-%m-%dT%H:%M:%S.%3%Z', of param: props.conf / [] / TIME_FORMAT.

can anyone help me in correcting it?

[s2_splunk · Accepted solution]

Try with TIME_FORMAT as "%Y-%m-%dT%H:%M:%S.%3N%Z"