https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176364#M35362 <P>Splunk should be able to parse the timestamp without Weekday part. To do parsing including, specify Timestmap format while import or in props.conf.</P> <PRE><CODE>[yoursourcetype] TIME_FORMAT = %a %b %d %H:%M:%S %Z %Y . . </CODE></PRE> Thu, 06 Mar 2014 18:49:58 GMT somesoni2 2014-03-06T18:49:58Z https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176361#M35359 <P>Splunk is struggling with this log format. any advise on how to get splunk to read the time stamp with day of the week included?:</P> <P>Thu Mar 06 08:08:07 PST 2014 LogSource=SERVICE ExperimentId=2897 MessageCount=1<BR /> Thu Mar 06 08:08:07 PST 2014 LogSource=SERVICE ExperimentId=3112 MessageCount=4<BR /> Thu Mar 06 08:08:07 PST 2014 LogSource=SERVICE ExperimentId=3391 MessageCount=2<BR /> Thu Mar 06 08:08:07 PST 2014 LogSource=SERVICE ExperimentId=3594 MessageCount=7<BR /> Thu Mar 06 08:08:07 PST 2014 LogSource=SERVICE ExperimentId=2634 MessageCount=406</P> Thu, 06 Mar 2014 16:34:28 GMT https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176361#M35359 smudge797 2014-03-06T16:34:28Z https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176362#M35360 <P>Splunk does not need the day of the week in text, because it is there in number. Have you tried specifying a TIME_FORMAT without it?<BR /> <CODE>%B %d %H:%M:%S %Z %Y</CODE></P> Thu, 06 Mar 2014 17:14:25 GMT https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176362#M35360 lukejadamec 2014-03-06T17:14:25Z https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176363#M35361 <P>whats the issue in this, it's pretty straight forward for splunk, reading it properly with the timezone as well.</P> Thu, 06 Mar 2014 18:07:28 GMT https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176363#M35361 linu1988 2014-03-06T18:07:28Z https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176364#M35362 <P>Splunk should be able to parse the timestamp without Weekday part. To do parsing including, specify Timestmap format while import or in props.conf.</P> <PRE><CODE>[yoursourcetype] TIME_FORMAT = %a %b %d %H:%M:%S %Z %Y . . </CODE></PRE> Thu, 06 Mar 2014 18:49:58 GMT https://community.splunk.com/t5/Getting-Data-In/time-stamp-including-day-of-the-week/m-p/176364#M35362 somesoni2 2014-03-06T18:49:58Z