https://community.splunk.com/t5/Getting-Data-In/Setting-the-timestamp-on-a-log-entry/m-p/86892#M18027 <P>I can't seem to get this working, logs are getting confused about the time format since it is Day Month Year. </P> <P>the log is in /var/log/holly/alarms.20120307-001.log</P> <PRE><CODE>07/03/12 17:33:54;test2 more props.conf [source::/var/log/holly/*alarms*"] TIME_PREFIX = ^ TIME_FORMAT = %d/%m/%y %H:%M:%S; </CODE></PRE> Wed, 07 Mar 2012 22:46:40 GMT imacdonald2 2012-03-07T22:46:40Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-timestamp-on-a-log-entry/m-p/86892#M18027 <P>I can't seem to get this working, logs are getting confused about the time format since it is Day Month Year. </P> <P>the log is in /var/log/holly/alarms.20120307-001.log</P> <PRE><CODE>07/03/12 17:33:54;test2 more props.conf [source::/var/log/holly/*alarms*"] TIME_PREFIX = ^ TIME_FORMAT = %d/%m/%y %H:%M:%S; </CODE></PRE> Wed, 07 Mar 2012 22:46:40 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-timestamp-on-a-log-entry/m-p/86892#M18027 imacdonald2 2012-03-07T22:46:40Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-timestamp-on-a-log-entry/m-p/86893#M18028 <P>If I change the source to [source::/var/log/holly/alarms.*.log] it now works,<BR /> Grrr. I think I see the typo, the " at the see of the source. </P> Thu, 08 Mar 2012 00:03:16 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-timestamp-on-a-log-entry/m-p/86893#M18028 imacdonald2 2012-03-08T00:03:16Z