<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to define timestamp in props.conf for JSON events? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-define-timestamp-in-props-conf-for-JSON-events/m-p/626245#M107592</link>
    <description>&lt;P&gt;I will be ingesting a JSON file daily that has a K/V field for the date as follows:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;"Date":  "2023-01-04"&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I just want to verify the time format in the props.conf file should be set as follows:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;TIME_FORMAT=%y-%m-%d&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;Thx&lt;/P&gt;</description>
    <pubDate>Fri, 06 Jan 2023 22:32:05 GMT</pubDate>
    <dc:creator>jwalzerpitt</dc:creator>
    <dc:date>2023-01-06T22:32:05Z</dc:date>
    <item>
      <title>How to define timestamp in props.conf for JSON events?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-define-timestamp-in-props-conf-for-JSON-events/m-p/626245#M107592</link>
      <description>&lt;P&gt;I will be ingesting a JSON file daily that has a K/V field for the date as follows:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;"Date":  "2023-01-04"&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I just want to verify the time format in the props.conf file should be set as follows:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;TIME_FORMAT=%y-%m-%d&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;Thx&lt;/P&gt;</description>
      <pubDate>Fri, 06 Jan 2023 22:32:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-define-timestamp-in-props-conf-for-JSON-events/m-p/626245#M107592</guid>
      <dc:creator>jwalzerpitt</dc:creator>
      <dc:date>2023-01-06T22:32:05Z</dc:date>
    </item>
    <item>
      <title>Re: Defining timestamp in props.conf for JSON events</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-define-timestamp-in-props-conf-for-JSON-events/m-p/626257#M107595</link>
      <description>&lt;P&gt;You're close.&amp;nbsp; The correct time format is&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;TIME_FORMAT=%Y-%m-%d&lt;/LI-CODE&gt;&lt;P&gt;Use upper-case 'Y' for 4-digit years and lower-case 'y' for 2-digit years.&lt;/P&gt;</description>
      <pubDate>Fri, 06 Jan 2023 21:08:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-define-timestamp-in-props-conf-for-JSON-events/m-p/626257#M107595</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2023-01-06T21:08:15Z</dc:date>
    </item>
  </channel>
</rss>

