Timeformat

[uagraw01]

Hello Splunkers !!

What timeformat should i use for the below time in props?

[2021-09-06T09:10:01.459-04:00]

[gcusello · Accepted solution]

Hi @uagraw01,

you should use:

TIME_PREFIX = \[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z

For more infos see at https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables

Ciao.

Giuseppe

[uagraw01]

@gcusello Its working thanks for your help

[gcusello]

Hi @uagraw01,

you're welcome!

Good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉