Getting Data In
Highlighted

Timestamp extraction for varying subseconds and time zones?

Contributor

How do you extract a timestamp from message having

event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC

event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST

where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc.

0 Karma
Highlighted

Re: Timestamp extraction for varying subseconds and time zones?

Motivator

If you have multiple timestamp formats in single log file, then try configuring datetime.xml. Refer to below docs for more information.

http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

0 Karma
Highlighted

Re: Timestamp extraction for varying subseconds and time zones?

SplunkTrust
SplunkTrust

looks like splunk can handle it,

try below props.conf

[odd_timestamp]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9N, Timezone:%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=48

worked for me,
see screenshot below:

alt text