https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84600#M17580 <P>I would like to update the date and timestamp for an event during indexing.</P> <P>The data is in the following format:</P> <P><TIMESTAMP>2012-03-05T18:21:20.533</TIMESTAMP><F1>adfaf</F1><F2>adfsafsdf</F2></P> <P>The timestamp value is in GMT format and I need to convert it into PDT / PST. Splunk Server runs in PST/PDT.</P> <P>Would just setting the TIME_FORMAT take care of it or do I need to set the Prefix too?</P> Mon, 05 Mar 2012 18:55:00 GMT danurag 2012-03-05T18:55:00Z https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84600#M17580 <P>I would like to update the date and timestamp for an event during indexing.</P> <P>The data is in the following format:</P> <P><TIMESTAMP>2012-03-05T18:21:20.533</TIMESTAMP><F1>adfaf</F1><F2>adfsafsdf</F2></P> <P>The timestamp value is in GMT format and I need to convert it into PDT / PST. Splunk Server runs in PST/PDT.</P> <P>Would just setting the TIME_FORMAT take care of it or do I need to set the Prefix too?</P> Mon, 05 Mar 2012 18:55:00 GMT https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84600#M17580 danurag 2012-03-05T18:55:00Z https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84601#M17581 <P>You need to set the prefix as well, since TIME_FORMAT will only look at the beginning of the line, by default:</P> <PRE><CODE>TIME_PREFIX = &lt;timestamp&gt; TIME_FORMAT = %Y-%m-%dT%T.%Q TZ = UTC </CODE></PRE> Mon, 05 Mar 2012 19:51:14 GMT https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84601#M17581 Stephen_Sorkin 2012-03-05T19:51:14Z https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84602#M17582 <P>Thank you Steve. This helped greatly.</P> Wed, 07 Mar 2012 21:27:56 GMT https://community.splunk.com/t5/Getting-Data-In/Date-and-Time-Extraction-from-XML/m-p/84602#M17582 danurag 2012-03-07T21:27:56Z