Team,
In my JSON data, there is below line which I want to be my event time (_time).
"eventDateTime" : "2017-24-08T05:19:54.500-05:00",
My props.conf has below entry. I am not sure what to write for last (-05:00). Please help.
TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N
TIME_PREFIX="eventDateTime" :
%Y-%d-%mT%H:%M:%S%3N%:z
try that.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
HI anantdeshpande,
-05.00 is the timezone, put %z at the end of your TIME_FORMAT
TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N-%z
Check if brackets are in or out of your time field.
Bye.
Giuseppe