Solved: Re: Timeformat - Splunk Community

Splunk Search

Hello Splunkers !!

What timeformat should i use for the below time in props?

[2021-09-06T09:10:01.459-04:00]

1 Solution

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

View solution in original post

Solution

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

@gcusello Its working thanks for your help

you're welcome!

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26 With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us. The ...