Timestamp Regex need help here!

[christantoy]

Good Day Splunkers

Can you help me to define this in regex format??

Sat Mar  2 01:02:02 2013 +08:00

Thanks in advance

[christantoy]

Yes your right Ayn... it's strptime/strime... it working now thanks a lot for the support...

Take care alway....

[Ayn]

For the record, the format strings you define for parsing timestamps are not regular expressions, they're strptime/strftime format specifiers.

[yannK]

here is what you need : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

for your example, it should look in the sourcetype definition like :
TIMEFORMAT=%a %b %e %H:%M:%S %Y %Z
please try on the data input preview to confirm.

[lguinn2]

Although I would add "why do you need to specify this?" Splunk is remarkably good at figuring out timestamps and this one is not hard. Splunk really shouldn't need you to specify anything - it can automatically handle this!

[christantoy]

To set a new timestamp for my data instead of default splunk timestamp

[emiller42]

What are you trying to accomplish here?