https://community.splunk.com/t5/Getting-Data-In/Capturing-time-from-a-new-data-input/m-p/136812#M28167 <P>I am having problems formatting the date/time for a new data source. I have posted an example with six lines. The first three lines are only getting the time captured and the second three lines are working properly. I have tried regex, specified the time format and using a preface. Any help you can give would be greatly appreciated.</P> <P>Thank you,<BR /> Don</P> <P>-rw-r--r-- 1 t9266 Domain Users 52210 Jun 14 05:38 EAI_CGIRespToADHOC_MF_ReqId_Q565701528.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 193537 Jun 14 05:41 EAI_CGIRespToADHOC_MF_ReqId_Q567401787.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 184729 Jun 14 05:44 EAI_CGIRespToADHOC_MF_ReqId_Q567802243.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 6596 Jun 16 11:07 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 2239.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 6620 Jun 16 14:40 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 8359.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 186290 Jun 16 20:55 EAI_CGIRespToADHOC_MF_ReqId_Q538004157.eml</P> Mon, 28 Sep 2020 17:02:03 GMT DonDandrea 2020-09-28T17:02:03Z https://community.splunk.com/t5/Getting-Data-In/Capturing-time-from-a-new-data-input/m-p/136812#M28167 <P>I am having problems formatting the date/time for a new data source. I have posted an example with six lines. The first three lines are only getting the time captured and the second three lines are working properly. I have tried regex, specified the time format and using a preface. Any help you can give would be greatly appreciated.</P> <P>Thank you,<BR /> Don</P> <P>-rw-r--r-- 1 t9266 Domain Users 52210 Jun 14 05:38 EAI_CGIRespToADHOC_MF_ReqId_Q565701528.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 193537 Jun 14 05:41 EAI_CGIRespToADHOC_MF_ReqId_Q567401787.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 184729 Jun 14 05:44 EAI_CGIRespToADHOC_MF_ReqId_Q567802243.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 6596 Jun 16 11:07 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 2239.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 6620 Jun 16 14:40 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 8359.eml<BR /> -rw-r--r-- 1 t9266 Domain Users 186290 Jun 16 20:55 EAI_CGIRespToADHOC_MF_ReqId_Q538004157.eml</P> Mon, 28 Sep 2020 17:02:03 GMT https://community.splunk.com/t5/Getting-Data-In/Capturing-time-from-a-new-data-input/m-p/136812#M28167 DonDandrea 2020-09-28T17:02:03Z https://community.splunk.com/t5/Getting-Data-In/Capturing-time-from-a-new-data-input/m-p/136813#M28168 <P>This works for me with sample data.</P> <PRE><CODE>[YourSourceType] TIME_FORMAT=%B %d %H:%M TIME_PREFIX=\w+\s\d+\s NO_BINARY_CHECK=1 </CODE></PRE> Thu, 10 Jul 2014 13:37:20 GMT https://community.splunk.com/t5/Getting-Data-In/Capturing-time-from-a-new-data-input/m-p/136813#M28168 somesoni2 2014-07-10T13:37:20Z