<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">In local.bro, add the following line...</p>
<pre style="background-color:#F7F7F7; border-radius:5px 5px 5px 5px; margin-left:15px; margin-right:15px; max-width:90vw; overflow-x:auto; padding:5px; color:black" bgcolor="#F7F7F7"><code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0" bgcolor="#F7F7F7"><span style="color: #008800; font-weight: bold">redef</span> LogAscii<span style="color: #0e84b5; font-weight: bold">::</span>json_timestamps <span style="color: #333333">=</span> JSON<span style="color: #0e84b5; font-weight: bold">::</span>TS_ISO8601;
</code></pre>
<p dir="auto">That should make your log have timestamps in ISO8601 time format which most systems natively recognize and understand.</p>
<p dir="auto">.Seth</p>
<p dir="auto">On 29 Oct 2019, at 23:31, venkatesh bandari wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">Hello team,<br>
<br>
we are doing a zeek poc.iam doing the integration with splunk.in the spunk<br>
logs i see the ts value which is not in human readable<br>
format.zeek-cut/bro-cut on the box can be used to convert ts to human<br>
readable format using -d<br>
<br>
the question is how can i do this before sending the json logs to splunk.is<br>
there a way<br>
<br>
Thanks<br>
Venkatesh<br>
_______________________________________________<br>
Zeek mailing list<br>
zeek@zeek.org<br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" style="color:#777">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">--<br>
Seth Hall * Corelight, Inc * <a href="http://www.corelight.com" style="color:#3983C4">www.corelight.com</a></p>
</div>
</div>
</body>
</html>