Can you post an example of the timestamp? The GUI seemed pretty helpful in setting it up. Yes, usually this kind of thing is handled by props.conf, but in this case you'll need to edit the inputs.conf. In my case it's /opt/splunk/etc/apps/dbx/local/inputs.conf . I found that some things in the Java SimpleDateFormat aren't implemented, so make sure to check your var/log/splunk/dbx.log for errors. ... View more

I struggled with this today. I eventually made it work by using convert(VARCHAR(35),TimeStamp,126) + '-0000' as TimeStampWtz In addition, I think you have to make sure to output the timestamp. The pertinent components to inputs.conf: output.format = kv output.timestamp = 1 output.timestamp.column = TimeStampWtz output.timestamp.format = yyyy-MM-dd'T'HH:mm:ss.SSSZ The format is specified in Java SimpleDateFormat, though it doesn't seem to be completely implemented. ... View more