Skip to main content

Time formats

The timestamp is an integral component of an event that underlies all observability analysis. In most cases, Imply Lumi automatically parses the timestamp from an incoming event and stores its timestamp.

For some data formats, you may need to configure Lumi to identify the timestamp from the raw event message. If Lumi can't detect the timestamp, it assigns the timestamp for when it received the event.

This topic lists the available time formats you can specify in a timestamp processor or during JSON file upload.

Applications

You can specify a custom time format in a timestamp mapper and for JSON file upload.

Within a pipeline, the timestamp mapper processor assigns the event timestamp. You can use metadata from a forwarding agent or an attribute generated by an upstream processor as the source attribute for the timestamp mapper.

When you upload a file with newline-delimited JSON data, designate the field containing the timestamp and the format of the timestamp. Note that supported CSV files already include timestamps with designated time zones.

The time formats described in this topic don’t apply to the S2S integrations, which use timestamps from the incoming events. For details on how Splunk® determines the timestamp and time zone, see Configure timestamp recognition and Specify time zones for timestamps.

Time formats

You can select from one of the following time formats:

Time formatDescriptionExample
ISO_8601ISO 8601 standard2025-07-01T02:47:05.000Z
EPOCH_SECONDSNumber of seconds since epoch time1749599182
EPOCH_MILLISECONDSNumber of milliseconds since epoch time1749599182000
EPOCH_MICROSECONDSNumber of microseconds since epoch time1749599182000000
EPOCH_NANOSECONDSNumber of nanoseconds since epoch time1749599182000000000
DATEHTTP date formatTue, 15 Nov 1994 08:12:31 GMT
CLFCommon log format10/Oct/2011:13:55:36 -0700
CUSTOMCustom time pattern using DateTimeFormatter syntaxyyyy-MM-dd HH:mm:ss to represent 2025-08-05 15:45:00

The epoch time represents the Unix epoch: January 1, 1970, at 00:00:00 Coordinated Universal Time (UTC).

Time zone

When Lumi detects a time zone on the event timestamp, it preserves the designated time zone. For example, 2023-10-26T15:30:00-05:00 denotes the timestamp five hours behind UTC. The preceding examples for ISO 8601, HTTP date, and common log format all include the time zone.

For timestamps that don't include time zone information, you can select a default time zone to use. When a timestamp doesn't contain the time zone and no default time zone has been selected, Lumi defaults to UTC.

User account

The time zone configured on your account determines the timestamps you view on events. Set your time zone in your profile settings:

User time zone

For example, consider an event in UTC time, 2025-07-01T02:47:05.000Z.

If your account is set to UTC time, you'd view the same date and time on the event, Jul 01, 02:47:05.000 AM. If you account time zone is America/Los_Angeles during daylight savings time, you'd view the timestamp as seven hours behind UTC, or Jun 30, 07:47:05.000 PM.

Custom format

The CUSTOM time format supports specifying the time zones in multiple ways, shown in the following table:

SymbolDescriptionTimestamp exampleAssociated pattern
VVTime zone ID2025-10-01T09:55:36 America/New_Yorkyyyy-MM-dd'T'HH:mm:ss VV
zTime zone nameWed, 01 Oct 2025 13:55:36 GMTEEE, dd MMM yyyy HH:mm:ss z
ZOffset from UTC, +HHMM or -HHMM01/Oct/2025:22:55:36 +0900dd/MMM/yyyy:HH:mm:ss Z
XOffset from UTC, +HH2025-10-01T14:55:36+01yyyy-MM-dd'T'HH:mm:ssX
XXOffset from UTC, +HHMM2025-10-01T14:55:36+0100yyyy-MM-dd'T'HH:mm:ssXX
XXXOffset from UTC, +HH:MM2025-10-01T14:55:36+01:00yyyy-MM-dd'T'HH:mm:ssXXX
OLocalized offset from UTC, short form2025-10-01T14:55:36 GMT+1yyyy-MM-dd'T'HH:mm:ss O
OOOOLocalized offset from UTC, long form2025-10-01T14:55:36 GMT+01:00yyyy-MM-dd'T'HH:mm:ss OOOO

If only some timestamps have the time zone, use square brackets [] to denote optionality. For example, yyyy-MM-dd'T'HH:mm:ss[XX].

See Time format for more information on this format.

Learn more

For more information, see the following topics: