Hi there, I have log with format like this "timestamp_mrt": "2017-12-03T15:30:36.208Z" but I would like to change the output becoming "timestamp_mrt": "2017-03-12 15:30:36.208" Do I need to convert to something first before converting to that desired result? *edit I tried with adding the Timestamp format %Y-%m-%d\s%H:%M:%S.%3Q but got an error saying "could not use strp time to parse ..." Thx ... View more

Hi, I'm new in Splunk, hope you can guide step by step please. How do I map or link a timestamp field (eg. timestamp_mrt) into _time so I can search on it? Right now my timestamp is none. Here the log that I loaded into Splunk { "received_bytes": "28942", "srcip": "***************", "src_port": "42012", "dstport": "443", "action": "allow", "type": "checkpoint_fw", "dst_port": "443", "log_sequence_num": "0", "LastUpdateTime": "1512314958", "host": "**************", "action": "allow", "dstip": "**************", "__policy_id_tag": "product=VPN-1 & FireWall-1[db_tag={10F51296-63EA-884A-BF05-579D4499EA21}", "app_id": "60519733", "protocol": "tcp", "app_rule_name": " ", "timestamp_mrt": "2017-12-03T15:30:36.208Z", "is_first_for_luuid": "0", "reporting_host": "****************", "Suppressed logs": "19", "browse_time": "0:00:00", "host": "***************", "dst_ip": "**************", "port": 51354, "i/f_name": "eth1-01", "proto": "tcp", "app_risk": "1", "src_ip": "*****************", "app_rule_id": "{B9494762-1D04-444B-A1F5-373B2DEC6CEE}", "app_category": "Network Protocols", "log_version": "1", "reportingHost": "*****************", "appi_name": "HTTP/2 over TLS", "rule": " ", "app_sig_id": "60519733:10", "cp_fwProductName": "Application Control", "typeNo": "13", "sent_bytes": "24332", "cp_date": "03Dec2017 14:50:17", "app_properties": "Very Low Risk, Network Protocols, Communication Standard", "log_type": "log", "has_accounting": "0", "cp_hostip": "**************", "@version": "1", "logId": "-1", "matched_category": "Network Protocols", "proxy_src_ip": "172.26.2.10", "product": "Application Control", "i/f_dir": "outbound", "origin_sic_name": "CN=fw1,O=fw..vtvb5n", "@timestamp": "2017-12-03T15:30:36.208Z", "bytes": "53274", "srcport": "42012", "app_desc": "HTTP/2 provides an optimized transport for HTTP semantics. HTTP/2 supports all of the core features of HTTP/1.1, but aims to be more efficient in several ways. HTTP/2 over TLS allows HTTP/2 connections over a secured TLS connection. Supported from: R75.40." } thank you!! ... View more