Solved: Timeformat - Splunk Community

Splunk Search

Hello Splunkers !!

What timeformat should i use for the below time in props?

[2021-09-06T09:10:01.459-04:00]

1 Solution

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

View solution in original post

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

@gcusello Its working thanks for your help

you're welcome!

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas We’ve all been there. You’re ...

Hello POJO, meet nocode

What's the Challenge? Instrumentation agents are highly advanced bits of software that manipulate bytecode, ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...