topic Re: Splunk Time_format and Timestamp prefix option in Getting Data In

Splunk Time_format and Timestamp prefix option?

poojithavasanth — Wed, 01 Apr 2026 16:38:53 GMT

I have the data has "1111|xxx, xxx y|000000|111111|firstname, lastname|10/13/22 02:12:09|"

I used TIME_FORMAT = %m/%d/%Y %H:%M:%S

and Timestamp prefix = ^(?:[^\|\n]*\|){5}

However, I still get an error stating could not use strptime to parse the timestamp.

Would need help in providing timestamp prefix here.

Re: Splunk Time_format and Timestamp prefix option

gcusello — Thu, 13 Oct 2022 12:15:12 GMT

Hi @poojithavasanth,

I suppose that when you say "Timestamp prefix" you mean TIME_PREFIX, is it correct?

Ciao.

Giuseppe

Re: Splunk Time_format and Timestamp prefix option

poojithavasanth — Thu, 13 Oct 2022 12:25:04 GMT

Yes, it is TIME_PREFIX

Re: Splunk Time_format and Timestamp prefix option

gcusello — Thu, 13 Oct 2022 12:49:26 GMT

Hi @poojithavasanth,

is your extraction a csv?

did you tried with INDEXED_EXTRACTION = csv?

Anyway, to debug your problem try to manually add a sample of your data using the GUI (Add data) in this way, you can immediately try different options.

Maybe the problem is Lookahead , try with a minor value e,g, 63.

ciao.

Giuseppe

Re: Splunk Time_format and Timestamp prefix option

poojithavasanth — Thu, 13 Oct 2022 13:33:55 GMT

File is in .txt format and file content are in psv (pipe-delimited)

Also, Lookahead with 63 did not work too. I believe there should be some updates in TIME_PREFIX.

Re: Splunk Time_format and Timestamp prefix option

gcusello — Thu, 13 Oct 2022 14:56:50 GMT

Hi @poojithavasanth,

please try this:

TIME_PREFIX = ^([^\|]+\|){5}

Ciao.

Giuseppe

Re: Splunk Time_format and Timestamp prefix option?

poojithavasanth — Thu, 13 Oct 2022 15:26:02 GMT

Thanks for the providing this information. I still do not see it working.

Re: Splunk Time_format and Timestamp prefix option?

gcusello — Thu, 13 Oct 2022 15:33:18 GMT

Hi @poojithavasanth,

trying with Add data, try to leave the auto detection.

In other words, set the TIME_FORMAT but not the TIME_PREFIX, if you haven't any other date in the log it should recognize the timestamp.

Ciao.

Giuseppe

Re: Splunk Time_format and Timestamp prefix option?

poojithavasanth — Thu, 13 Oct 2022 15:44:05 GMT

I see it recognizes the timestamp without adding TIME_PREFIX but with an error "could not use strptime to parse timetsamp".

My goal is to clear the error, which is only possible by adding TIME_PREFIX which suits the situation.

Re: Splunk Time_format and Timestamp prefix option?

gcusello — Fri, 14 Oct 2022 06:19:04 GMT

Hi @poojithavasanth,

if you have the above error, Splunk assignes the current timestamp to the event.

Did you tried to use the Add-data function to find the correct timestamp?

I tried using your data and the automatic recognition recognizes your timestamp

Ciao.

Giuseppe

Re: Splunk Time_format and Timestamp prefix option?

PickleRick — Fri, 14 Oct 2022 07:29:21 GMT

Firstly, unless you have some strange linebreakers, you don't have to account for \n within the event.

Secondly, if memory serves me right, within a character set you don't escape characters.

So you can try with

TIME_PREFIX = ^([^|]*|){5}

And you need %y instead of %Y (you don't have full year number, just two last digits)