Getting Data In

GeoJSON data has timezone expressed in minutes offset from UTC

splunk_zen
Builder

Trying to consume some seismic data which input has a timestamp expressed in epoch time, but a timezone offset field expressed in

[-1200, +1200]
Description
Timezone offset from UTC in minutes at the event epicenter.

the offset above has no correlation with the known props.conf TIME_FORMAT's timezones

%z  UTC offset in the form +HHMM 

Was thinking about setting up a custom datetime.xml but couldn't find any "extract=" variable there meant to grab offsets,
couldn't find the python module which parses datetime.xml either

How should we approach this?

Tags (3)
0 Karma

acharlieh
Influencer

Is this the format specification of the data you're working with?

If so then you don't need any translation as the time field is already milliseconds since the UTC epoch. The tz field can be used at search time to help group events based on the local time, but per the spec doesn't seem to be needed for parsing events into Splunk correctly.

You could use a props.conf setting to say TIME_FORMAT = %s%3N although this might change slightly (and deployment may change slightly) depending on if you're using INDEXED_EXTRACTIONS, and thus could specify the field that contains the time or not.

splunk_zen
Builder

Yes acharlieh, wanted to help a colleague which came up with this question and got carried away with the redundant offset. epoch is UTC so already provides time trustability
Yep either setting this with a TIME_PREFIX and TIME_FORMAT combo or setting JSON INDEXED_EXTRACTIONS and TIMESTAMP_FIELDS = time

DalJeanis
SplunkTrust
SplunkTrust

You already have local epoch time.

Perhaps just add them together (or delta them, whichever works accurately) to calculate UTC epoch time.

splunk_zen
Builder

Thanks DalJeanis,
Think I jumped the gun when I saw the offset and thus got confused
If we already have epoch (meaning UTC), we already have the real time the event happened

Was concerned about getting _time correct during indexing but UTC already ensures that

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

... that makes more sense.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...