Timestamp extraction for varying subseconds and time zones?

[ankithreddy777]

How do you extract a timestamp from message having

event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC

event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST

where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc.

[adonio]

looks like splunk can handle it,

try below props.conf

[odd_timestamp]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9N, Timezone:%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=48

worked for me,
see screenshot below:

[sudosplunk]

If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information.

http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html