Getting Data In

Why is TIME_FORMAT not working?

himanshu1
Loves-to-Learn Lots

Hello Friends,

In a sourcetype , data are coming in from multiple hosts and host are residing in diff-2 time zones.

In raw logs we can see time zone is also mentioned, I want to write a generic TIME_FORMAT for this.

time stamps example :

Mar 7 09:18:00 SGT:
Mar 6 19:07:42 UTC:
Mar 7 01:31:58.460 WST:
Mar 7 09:13:17.384:

 

I tried like TIME_FORMAT= %b %d %H:%M:%S.%Q %Z , WHICH IS NOT WORKING.

%Z is not able to recognize time zone here , please help me with some other expression.

 

Thanks in advance :slightly_smiling_face:

Happy Splunking !  !

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can't have a single TIME_FORMAT for two different time specs.

You could try to extract a "base timestamp" from the event then offsetting it with data from timezone by INGEST_EVAL

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...