Splunk Search

setting the time format for timezone offset in props

Path Finder

hi,

I would like extract the timezone offset in time format in props.
example time format , 2017-02-05T01:20:10.049-0500: 0.855:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N-%Z

But the above timeformat which i defined is not working. I want my timestamp in splunk to have upto 2017-02-05T01:20:10.049-0500 ignoring 0.855

0 Karma
1 Solution

Splunk Employee
Splunk Employee

%Y-%m-%dT%H:%M:%S.%3N%Z

View solution in original post

Splunk Employee
Splunk Employee

%Y-%m-%dT%H:%M:%S.%3N%Z

View solution in original post

Path Finder

thank you for reply but it is not working.

0 Karma

Esteemed Legend

This needs to be deployed to your indexers and splunkd restarted there and even then only events that are indexed post-restart will show the effects of the new configurations.

Esteemed Legend

I see that this is accepted; so is it working now?

0 Karma