https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170609#M34494 <P>I have PSV files in such format. Date is in 2nd column.<BR /> Haven't spent much time to try different setting, but Splunk still took file modified time as event time stamp. I'm stilling asking myself what's wrong with "TIME_FORMAT= %Y%m%d"??</P> <P>Anyone can help to see what's wrong of my props.conf?</P> <P>foo|20131201|bar|...</P> <P>[unixops:sitelog]<BR /> SHOULD_LINEMERGE = false<BR /> TIME_FORMAT= %Y%m%d<BR /> LEARN_MODEL = false<BR /> INDEXED_EXTRACTIONS = PSV<BR /> FIELD_NAMES = host,date,log,message_type,region,city,campus,building,status,personality</P> Mon, 28 Sep 2020 17:15:54 GMT philip_wong 2020-09-28T17:15:54Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170609#M34494 <P>I have PSV files in such format. Date is in 2nd column.<BR /> Haven't spent much time to try different setting, but Splunk still took file modified time as event time stamp. I'm stilling asking myself what's wrong with "TIME_FORMAT= %Y%m%d"??</P> <P>Anyone can help to see what's wrong of my props.conf?</P> <P>foo|20131201|bar|...</P> <P>[unixops:sitelog]<BR /> SHOULD_LINEMERGE = false<BR /> TIME_FORMAT= %Y%m%d<BR /> LEARN_MODEL = false<BR /> INDEXED_EXTRACTIONS = PSV<BR /> FIELD_NAMES = host,date,log,message_type,region,city,campus,building,status,personality</P> Mon, 28 Sep 2020 17:15:54 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170609#M34494 philip_wong 2020-09-28T17:15:54Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170610#M34495 <P>In your case, you need to set <CODE>TIME_PREFIX</CODE> and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE>. Check the props.conf documenattion<BR /> <A href="http://">http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Propsconf</A></P> <PRE><CODE>TIME_PREFIX = foo| MAX_TIMESTAMP_LOOKAHEAD = 12 </CODE></PRE> <P>Try these. Change the values as required.</P> Tue, 05 Aug 2014 10:19:46 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170610#M34495 strive 2014-08-05T10:19:46Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170611#M34496 <P>"foo" is not fixed value.</P> <P>I did try TIME_PREFIX = | and MAX_TIMESTAMP_LOOKAHEAD = 50 , still didn't work</P> Mon, 28 Sep 2020 17:16:24 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170611#M34496 philip_wong 2020-09-28T17:16:24Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170612#M34497 <P>Can you tell what will be there before |20131201. Is it one word or multiple words separated by |.</P> Wed, 06 Aug 2014 02:44:34 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170612#M34497 strive 2014-08-06T02:44:34Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170613#M34498 <P>It works now. A silly mistake...</P> <P>I didn't pay attention TIME_PREFIX is regex based.<BR /> So the answer is </P> <PRE><CODE>TIME_PREFIX = \| </CODE></PRE> <P>Thanks helping me!</P> Wed, 06 Aug 2014 09:03:06 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170613#M34498 philip_wong 2014-08-06T09:03:06Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170614#M34499 <P>Good to know that it worked. Dont forget to accept the answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 06 Aug 2014 09:12:29 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-simple-YYYYMMDD-data-to-be-event-date/m-p/170614#M34499 strive 2014-08-06T09:12:29Z