Getting Data In
Highlighted

Time format throwing error

Path Finder

Hello All,

i have a sourcetype with timestamp as "2017-10-10T18:55:47.425Z" and i defined TIME_FORMAT as "%Y-%m-%dT%H:%M:%S.%3%Z" but seems to be issue am getting the following error

Bad strptime format value: '%Y-%m-%dT%H:%M:%S.%3%Z', of param: props.conf / [] / TIME_FORMAT.

can anyone help me in correcting it?

0 Karma
Highlighted

Re: Time format throwing error

Splunk Employee
Splunk Employee

Try with TIME_FORMAT as "%Y-%m-%dT%H:%M:%S.%3N%Z"

View solution in original post

0 Karma