zeek ts conversion

Zeek
1

Hello team,

we are doing a zeek poc.iam doing the integration with splunk.in the spunk logs i see the ts value which is not in human readable format.zeek-cut/bro-cut on the box can be used to convert ts to human readable format using -d

the question is how can i do this before sending the json logs to splunk.is there a way

Thanks
Venkatesh

2

In local.bro, add the following line…

redef LogAscii::json_timestamps = JSON::TS_ISO8601;

That should make your log have timestamps in ISO8601 time format which most systems natively recognize and understand.

.Seth

3

Thank you Seth