https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148575#M30246 <P>yes this is basically a complete event</P> <P>20150121<BR /> 1<BR /> 101834<BR /> 10:18:34:794<BR /> 2953 1</P> <P>CN0010001<BR /> HARI1<BR /> GROUP.DEBIT.INT<BR /> 1 I</P> <P>150121101834794</P> <P>this 150121101834794 is time given in event .. after this a new event is start with a same pattren <BR /> we have used time format for this event %y%m%d%H%M%S%3N</P> Mon, 23 Feb 2015 09:07:32 GMT splunk47 2015-02-23T09:07:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148573#M30244 <P>Sample Log Data:</P> <PRE><CODE>20150121 1 101834 10:18:34:794 2953 1 CN0010001 HARI1 GROUP.DEBIT.INT 1 I 150121101834794 </CODE></PRE> <P>How should I configure props.conf to take <CODE>150121101834794</CODE> as the timestamp and break the event after that.</P> Mon, 23 Feb 2015 07:33:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148573#M30244 splunk47 2015-02-23T07:33:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148574#M30245 <P>Is "150121101834794" a static string?</P> Mon, 23 Feb 2015 08:08:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148574#M30245 Ayn 2015-02-23T08:08:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148575#M30246 <P>yes this is basically a complete event</P> <P>20150121<BR /> 1<BR /> 101834<BR /> 10:18:34:794<BR /> 2953 1</P> <P>CN0010001<BR /> HARI1<BR /> GROUP.DEBIT.INT<BR /> 1 I</P> <P>150121101834794</P> <P>this 150121101834794 is time given in event .. after this a new event is start with a same pattren <BR /> we have used time format for this event %y%m%d%H%M%S%3N</P> Mon, 23 Feb 2015 09:07:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148575#M30246 splunk47 2015-02-23T09:07:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148576#M30247 <P>Please try below</P> <PRE><CODE>[logs] TIME_PREFIX = 1\sI\s+ TIME_FORMAT = %y%m%d%H%M%S%3N </CODE></PRE> Mon, 23 Feb 2015 10:04:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148576#M30247 satishsdange 2015-02-23T10:04:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148577#M30248 <P>ya, I think this should work - but the text-formatting on this site seems to have messed up the answer here (for TIME_PREFIX).. it should instead be <CODE>TIME_PREFIX = 1\s|\s+</CODE></P> <P>but then again, you'll need to confirm the <CODE>1 |</CODE> always appear just before the date/time string - otherwise you'll probably be better off using <CODE>MAX_TIMESTAMP_LOOKAHEAD = ###</CODE> - ### is some number of characters into the event Splunk should look for a timestamp</P> Mon, 28 Sep 2020 19:02:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-my-sample-data-to-recognize-the/m-p/148577#M30248 klee310 2020-09-28T19:02:28Z