https://community.splunk.com/t5/Getting-Data-In/Timestamps/m-p/82592#M17122 <P>Hi im importing logs from cisco switches and in the search the time that stays in the begginig of the events shows like this 27/09/2011 17:46:00.000 and never show the seconds. What can i do? Thanks</P> <P>I figured it out. I just change the option "MAX_TIMESTAMP_LOOKAHEAD" from 32 to 35 for cisco_syslog in props.conf. But now i wanna supress the .000 that shows in the end of the timestamp. How?</P> Mon, 28 Sep 2020 09:55:10 GMT drpsycho 2020-09-28T09:55:10Z https://community.splunk.com/t5/Getting-Data-In/Timestamps/m-p/82592#M17122 <P>Hi im importing logs from cisco switches and in the search the time that stays in the begginig of the events shows like this 27/09/2011 17:46:00.000 and never show the seconds. What can i do? Thanks</P> <P>I figured it out. I just change the option "MAX_TIMESTAMP_LOOKAHEAD" from 32 to 35 for cisco_syslog in props.conf. But now i wanna supress the .000 that shows in the end of the timestamp. How?</P> Mon, 28 Sep 2020 09:55:10 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamps/m-p/82592#M17122 drpsycho 2020-09-28T09:55:10Z https://community.splunk.com/t5/Getting-Data-In/Timestamps/m-p/82593#M17123 <P>From your first paragraph, it seems the ".000" is always there. Try hard-coding that in your TIME_FORMAT clause. That should eliminate that extra data.</P> Wed, 26 Jun 2013 13:39:55 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamps/m-p/82593#M17123 rgcurry 2013-06-26T13:39:55Z