https://community.splunk.com/t5/Getting-Data-In/Extract-epoch-and-tai64-time-from-imported-event/m-p/22126#M3359 <P>You cannot tell Splunk the <CODE>TIME_FORMAT</CODE> for <CODE>Tai64</CODE> but if you tell Splunk <CODE>TIME_PREFIX</CODE> and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE>, it will get it automatically correct (except for sub-seconds) and it should work for both <CODE>epoch</CODE> and <CODE>Tai64</CODE>:</P> <PRE><CODE>[sourcetype] TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 26 </CODE></PRE> Thu, 04 Jun 2015 20:01:41 GMT woodcock 2015-06-04T20:01:41Z https://community.splunk.com/t5/Getting-Data-In/Extract-epoch-and-tai64-time-from-imported-event/m-p/22125#M3358 <P>Hi</P> <P>Do you have any idea to decode Epoch time and Tai64 encoded time? </P> <P>I have several device their time is as below..</P> <P>completely have no idea on Tai64. for Epoch, I tried to put following in props.conf</P> <PRE><CODE>[sourcetype] TIME_FORMAT = %s </CODE></PRE> <P>but do not work .</P> <P>Time is Tai64</P> <PRE><CODE>@400000004de5bcd921686bec tcpserver: status: 0/40 @400000004de5bcd921686034 tcpserver: end 10611 status 256 @400000004de5bcd91d08caec tcpserver: ok 10611 0:192.168.2.33:110 :192.168.1.102::2029 @400000004de5bcd91d08c704 tcpserver: pid 10611 from 192.168.1.102 </CODE></PRE> <P>Time is Epoch</P> <PRE><CODE>1303380720.401 399 192.168.3.32 TCP_MISS/000 3437 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/4/0/str%3d0001.0A3D0009.4DB002F2.0054%2css%3d4%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:0:3392:192.168.3.32:1:0:18:: PROTOCOL-STAT:a@b.c:&lt;SNT115-W4378F7332227898850E657AE920@phx.gbl&gt;: PROXY-ERROR:: 1303365337.779 410 192.168.3.32 TCP_MISS/000 3313 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/3/0/str%3d0001.0A3D0009.4DAFC6DB.0037%2css%3d3%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:1:3393:192.168.3.32:1:0:13:: PROTOCOL-STAT:a@b.c:&lt;418ea2af3d2ec5aebde87ee2c78309ad@edm04.01webdesign.com.hk&gt;: PROXY-ERROR:: 1303365336.935 404 192.168.3.32 TCP_MISS/000 3308 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/3/0/str%3d0001.0A3D0009.4DAFC6DA.0054%2css%3d3%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:0:3392:192.168.3.32:1:0:16:: PROTOCOL-STAT:a@b.c:&lt;fa4fe4d1cb0c21701daea014a61fdde7@edm04.01webdesign.com.hk&gt;: PROXY-ERROR:: </CODE></PRE> Fri, 03 Jun 2011 12:03:20 GMT https://community.splunk.com/t5/Getting-Data-In/Extract-epoch-and-tai64-time-from-imported-event/m-p/22125#M3358 keiichilam 2011-06-03T12:03:20Z https://community.splunk.com/t5/Getting-Data-In/Extract-epoch-and-tai64-time-from-imported-event/m-p/22126#M3359 <P>You cannot tell Splunk the <CODE>TIME_FORMAT</CODE> for <CODE>Tai64</CODE> but if you tell Splunk <CODE>TIME_PREFIX</CODE> and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE>, it will get it automatically correct (except for sub-seconds) and it should work for both <CODE>epoch</CODE> and <CODE>Tai64</CODE>:</P> <PRE><CODE>[sourcetype] TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 26 </CODE></PRE> Thu, 04 Jun 2015 20:01:41 GMT https://community.splunk.com/t5/Getting-Data-In/Extract-epoch-and-tai64-time-from-imported-event/m-p/22126#M3359 woodcock 2015-06-04T20:01:41Z