timestamp question

[a212830]

hI,

Setting up a syslog feed and run into something that I haven't yet:

2014-03-17T02:02:26-04:00

What does the T stand for? The time is one hour behind the current timestamp, so I'm assuming that it's a timezone?

[starcher]

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?r=splunky
If Splunk is not auto detecting the timezone, you can force the timezone for a sourcetype as shown in the props documentation linked above; look for TZ =

[starcher]

T stands for time. the timezone adjustment is the -4:00 at the end.

[a212830]

Don't want to do it without props - trying to follow the recommended guidelines - configuring time_zone, time_format....

Here's what I have:

[acme_syslog]
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = 1
TIME_FORMAT = %y-%m-%dT%H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)
TZ = US/Central

[somesoni2]

Splunk can process this format without any props.conf configuration.

[a212830]

Thanks. I looked at the doc, but I'm still unclear. How would you reference the T? Or would you reference the -4:00?

[a212830]

So, how would I configure that in props.conf?