Solved: Timeformat - Splunk Community

Splunk Search

Hello Splunkers !!

What timeformat should i use for the below time in props?

[2021-09-06T09:10:01.459-04:00]

1 Solution

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

View solution in original post

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

@gcusello Its working thanks for your help

you're welcome!

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Data Management Digest – August 2026

Data Management Digest Welcome to the August 2026 edition of Data Management Digest! August was a big month ...