https://community.splunk.com/t5/Getting-Data-In/How-can-I-set-a-TIME-PREFIX-without-prefix/m-p/139517#M28679 <P>TIME_PREFIX = ^</P> Tue, 02 Jun 2015 13:55:57 GMT woodcock 2015-06-02T13:55:57Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-set-a-TIME-PREFIX-without-prefix/m-p/139516#M28678 <P>Hi folks,</P> <P>I wanted to add the first field as timestamp : </P> <PRE><CODE>150503;ULSTTTK073TTTXXX;XXXXXXXX;15/04/27;13:11:35 </CODE></PRE> <P>but my stanza in my props.conf doesn't match this field...</P> <PRE><CODE>[my_stanza] TIME_FORMAT=%y%m%d TIMESTAMP_FIELDS = DDATFCT TIME_PREFIX = MAX_TIMESTAMP_LOOKAHEAD=50 SHOULD_LINEMERGE=false NO_BINARY_CHECK=true KV_MODE=none disabled=false pulldown_type=true </CODE></PRE> <P>A transforms.conf is used to set FIELD_NAME with DDATFCT as first element.</P> <P>Do I set a null TIME_PREFIX to force to recognize my timestamp fields ?<BR /> Be aware that time fields doesn't have any prefixe...</P> <P>BR</P> <P>Nicolas Y.</P> Tue, 02 Jun 2015 09:55:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-set-a-TIME-PREFIX-without-prefix/m-p/139516#M28678 nicolasydder 2015-06-02T09:55:17Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-set-a-TIME-PREFIX-without-prefix/m-p/139517#M28679 <P>TIME_PREFIX = ^</P> Tue, 02 Jun 2015 13:55:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-set-a-TIME-PREFIX-without-prefix/m-p/139517#M28679 woodcock 2015-06-02T13:55:57Z