Solved: Timeformat - Splunk Community

Splunk Search

Hello Splunkers !!

What timeformat should i use for the below time in props?

[2021-09-06T09:10:01.459-04:00]

1 Solution

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

View solution in original post

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

@gcusello Its working thanks for your help

you're welcome!

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Developer Spotlight with Mika Borner

From Hackathon Winner to Enterprise Leader Mika Borner, CEO and Founder of Datapunctum AG, has been ...

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...