How do you extract a timestamp from message having
event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC
event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST
where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc.
looks like splunk can handle it,
try below props.conf
[odd_timestamp]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9N, Timezone:%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=48
worked for me,
see screenshot below:
If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information.
http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml
https://www.splunk.com/blog/2014/04/23/its-that-time-again.html