https://community.splunk.com/t5/Splunk-Enterprise/How-to-extract-time-from-log/m-p/503830#M1862 <P>Hi,</P><P>I want to extract the timestamp from my log and make it the official _time in Splunk and I'm having difficulties doing that. I'd like to keep the date current as there is no date in the log files.</P><P>This is an example of what a log looks like with the Splunk time:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="esalmon_0-1591835820262.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9115i1B6A69C45407DFBF/image-size/medium?v=v2&amp;px=400" role="button" title="esalmon_0-1591835820262.png" alt="esalmon_0-1591835820262.png" /></span></P><P>And this is my props.conf:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="esalmon_1-1591835864116.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9116i40BE555C639EA31D/image-size/medium?v=v2&amp;px=400" role="button" title="esalmon_1-1591835864116.png" alt="esalmon_1-1591835864116.png" /></span></P><P>I just want the time in the logs to match the time in Splunk, and I am not sure what I am doing wrong. Please help</P> Thu, 11 Jun 2020 00:39:58 GMT esalmon 2020-06-11T00:39:58Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-extract-time-from-log/m-p/503830#M1862 <P>Hi,</P><P>I want to extract the timestamp from my log and make it the official _time in Splunk and I'm having difficulties doing that. I'd like to keep the date current as there is no date in the log files.</P><P>This is an example of what a log looks like with the Splunk time:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="esalmon_0-1591835820262.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9115i1B6A69C45407DFBF/image-size/medium?v=v2&amp;px=400" role="button" title="esalmon_0-1591835820262.png" alt="esalmon_0-1591835820262.png" /></span></P><P>And this is my props.conf:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="esalmon_1-1591835864116.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9116i40BE555C639EA31D/image-size/medium?v=v2&amp;px=400" role="button" title="esalmon_1-1591835864116.png" alt="esalmon_1-1591835864116.png" /></span></P><P>I just want the time in the logs to match the time in Splunk, and I am not sure what I am doing wrong. Please help</P> Thu, 11 Jun 2020 00:39:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-extract-time-from-log/m-p/503830#M1862 esalmon 2020-06-11T00:39:58Z