https://community.splunk.com/t5/Getting-Data-In/Correct-timestamp-format-for-this-dbx-column/m-p/69485#M14097 <P>This looks like epoch time to me. If it is, then Splunk will figure it out properly. You could also put this in <CODE>props.conf</CODE></P> <PRE><CODE>[yoursourcetypehere] TIME_FORMAT=%s%3N </CODE></PRE> <P>If you want to give Splunk a little more help, you might add a <CODE>TIME_PREFIX</CODE> setting and <CODE>MAX_TIMESTAMP_LOOKAHEAD = 20</CODE></P> <P>Refer to <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition">Configure timestamp recognition</A> in the manuals for more info.</P> Thu, 20 Dec 2012 05:16:24 GMT lguinn2 2012-12-20T05:16:24Z https://community.splunk.com/t5/Getting-Data-In/Correct-timestamp-format-for-this-dbx-column/m-p/69484#M14096 <P>I have a datetime SQL column that I am indexing with the DBX app. I am trying to figure out the correct timestamp format to use for an output like: 1355960605.253</P> <P>Thanks</P> Wed, 19 Dec 2012 23:58:56 GMT https://community.splunk.com/t5/Getting-Data-In/Correct-timestamp-format-for-this-dbx-column/m-p/69484#M14096 virtualpony 2012-12-19T23:58:56Z https://community.splunk.com/t5/Getting-Data-In/Correct-timestamp-format-for-this-dbx-column/m-p/69485#M14097 <P>This looks like epoch time to me. If it is, then Splunk will figure it out properly. You could also put this in <CODE>props.conf</CODE></P> <PRE><CODE>[yoursourcetypehere] TIME_FORMAT=%s%3N </CODE></PRE> <P>If you want to give Splunk a little more help, you might add a <CODE>TIME_PREFIX</CODE> setting and <CODE>MAX_TIMESTAMP_LOOKAHEAD = 20</CODE></P> <P>Refer to <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition">Configure timestamp recognition</A> in the manuals for more info.</P> Thu, 20 Dec 2012 05:16:24 GMT https://community.splunk.com/t5/Getting-Data-In/Correct-timestamp-format-for-this-dbx-column/m-p/69485#M14097 lguinn2 2012-12-20T05:16:24Z