https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-a-Unix-timestamp-in-a-JSON-log/m-p/211183#M41579 <P>Try this:</P> <PRE><CODE>[your_sourcetype] TIME_PREFIX = "start":" TIME_FORMAT = %s.%3N </CODE></PRE> Wed, 20 Apr 2016 22:55:00 GMT twinspop 2016-04-20T22:55:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-a-Unix-timestamp-in-a-JSON-log/m-p/211182#M41578 <P>All, </P> <P>I have a json log file we're bringing in. </P> <P>Its time is logged as:</P> <PRE><CODE>"start":"1461191869.576” </CODE></PRE> <P>Any idea on where I would start with props.conf for timestamping?</P> Wed, 20 Apr 2016 22:45:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-a-Unix-timestamp-in-a-JSON-log/m-p/211182#M41578 daniel333 2016-04-20T22:45:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-a-Unix-timestamp-in-a-JSON-log/m-p/211183#M41579 <P>Try this:</P> <PRE><CODE>[your_sourcetype] TIME_PREFIX = "start":" TIME_FORMAT = %s.%3N </CODE></PRE> Wed, 20 Apr 2016 22:55:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-for-a-Unix-timestamp-in-a-JSON-log/m-p/211183#M41579 twinspop 2016-04-20T22:55:00Z