Tshark frame.time format

edit

To avoid the need for recompiling Wireshark, you could consider implementing a Lua post-dissector that reformats the frame.time field however you like. Below is one such Lua post-dissector that you may find useful. To use it, you will need to save it in your Wireshark plugins directory or explicitly specify to use it on the tshark command line.

local framepost = Proto("framepost", "frame post-dissector")

local pf = {
    ft = ProtoField.string("framepost.time", "Arrival Time")
}

-- Register protocol fields
framepost.fields = pf

local ft = Field.new("frame.time")

local function mon2num(mon)
    local mons = {
        ["Jan"] = 1, ["Feb"] = 2, ["Mar"] = 3, ["Apr"] = 4, ["May"] = 5, ["Jun"] = 6,
        ["Jul"] = 7, ["Aug"] = 8, ["Sep"] = 9, ["Oct"] = 10, ["Nov"] = 11, ["Dec"] = 12
    }

    return mons[mon]
end

function framepost.dissector(tvbuf, pinfo, tree)
    local ft_ex = ft()
    if ft_ex ~= nil then

        local framepost_tree = tree:add(framepost, "Frame Postdissector")

        local ft = ft_ex.display:gsub('(%a+)%s+(%d+),%s+(%d+)(.)',
            function(m, d, y, t)
                return y .. "-" .. ("%02d"):format(mon2num(m)) .. "-" .. ("%02d"):format(d) .. t
            end)

        framepost_tree:add(pf.ft, ft)
    end
end

register_postdissector(framepost)

Example Usage:

tshark -r 0001.pcap -X lua_script:framepost.lua -T fields -e framepost.time -e ip.src -e ip.dst

You would have to recompile Wireshark to do so, currently the format is hard-coded, see abs_time_to_str() in epan\to_str.c.

You could post-process the output using the tool of your choice to reformat the date.

You could submit an enhancement request to the Wireshark Bugzilla to add a field that allows the time format to be specified.

If this is still for Splunk, I believe by using Google and looking at their docs (I have never used Splunk) you can specify a time format for import, see Configure Timestamp Recognition and the TIME_FORMAT option. I'll leave the working out of that format as an exercise for the reader, but as a hint look at the examples.