https://community.splunk.com/t5/Getting-Data-In/Timestamp-issues/m-p/182413#M36581 <P>Use these settings in props.conf for that sourcetype:</P> <PRE><CODE>... MAX_TIMESTAMP_LOOKAHEAD=30 TIME_FORMAT=%m/%d/%Y, %k:%M:%S TIME_PREFIX=^\S+, </CODE></PRE> <P>The important bit is the %k for hours not prefixed by a zero when in single digits, by default Splunk looks for zero-prefixed hours only.</P> Fri, 24 Oct 2014 23:28:43 GMT martin_mueller 2014-10-24T23:28:43Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-issues/m-p/182412#M36580 <P>I have a timestamp that is not coming incorrectly. Splunk is reading the seconds portion of time in my event as minutes. </P> <P>COMPUTER1, 09/15/2014, 0:00:01 comes across as</P> <P>9/15/2015 12:01:00 AM</P> <P>How do I get it to see the seconds as seconds and not minutes?</P> Fri, 24 Oct 2014 14:41:52 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-issues/m-p/182412#M36580 skirkpatrick 2014-10-24T14:41:52Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-issues/m-p/182413#M36581 <P>Use these settings in props.conf for that sourcetype:</P> <PRE><CODE>... MAX_TIMESTAMP_LOOKAHEAD=30 TIME_FORMAT=%m/%d/%Y, %k:%M:%S TIME_PREFIX=^\S+, </CODE></PRE> <P>The important bit is the %k for hours not prefixed by a zero when in single digits, by default Splunk looks for zero-prefixed hours only.</P> Fri, 24 Oct 2014 23:28:43 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-issues/m-p/182413#M36581 martin_mueller 2014-10-24T23:28:43Z