Getting Data In

timestamp question

a212830
Champion

hI,

Setting up a syslog feed and run into something that I haven't yet:

2014-03-17T02:02:26-04:00

What does the T stand for? The time is one hour behind the current timestamp, so I'm assuming that it's a timezone?

Tags (1)
0 Karma

starcher
SplunkTrust
SplunkTrust

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?r=splunky
If Splunk is not auto detecting the timezone, you can force the timezone for a sourcetype as shown in the props documentation linked above; look for TZ =

starcher
SplunkTrust
SplunkTrust

T stands for time. the timezone adjustment is the -4:00 at the end.

0 Karma

a212830
Champion

Don't want to do it without props - trying to follow the recommended guidelines - configuring time_zone, time_format....

Here's what I have:

[acme_syslog]
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = 1
TIME_FORMAT = %y-%m-%dT%H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)
TZ = US/Central

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk can process this format without any props.conf configuration.

0 Karma

a212830
Champion

Thanks. I looked at the doc, but I'm still unclear. How would you reference the T? Or would you reference the -4:00?

0 Karma

a212830
Champion

So, how would I configure that in props.conf?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...