https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248669#M47857 <P>Maybe an example of what you are trying to do?</P> Fri, 13 May 2016 20:51:44 GMT ddrillic 2016-05-13T20:51:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248668#M47856 <P>I need to use the field email sent to YYYY-MM-DD format for timestamp.<BR /> How to set the timestamp for the YYYY-MM-DD format?</P> <P>Thanks.</P> Fri, 13 May 2016 20:38:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248668#M47856 dennisaraujo 2016-05-13T20:38:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248669#M47857 <P>Maybe an example of what you are trying to do?</P> Fri, 13 May 2016 20:51:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248669#M47857 ddrillic 2016-05-13T20:51:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248670#M47858 <P>In the file I have the email sent field, filled with date in yyyy-mm-dd format, I use this field as a timestamp to index the file.</P> Fri, 13 May 2016 21:04:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248670#M47858 dennisaraujo 2016-05-13T21:04:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248671#M47859 <P>You'd need to configure this in your props.conf for the sourcetype assigned to this data. To enable us to help you with more accurate solution, provide some sample log entries that you're trying to configure...</P> Fri, 13 May 2016 21:28:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248671#M47859 somesoni2 2016-05-13T21:28:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248672#M47860 <P>Try using the following in props.conf for your sourcetype:<BR /> TIME_FORMAT = %Y-%m-%d</P> Sat, 14 May 2016 02:01:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248672#M47860 phadnett_splunk 2016-05-14T02:01:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248673#M47861 <P>Worked, thank you.</P> Mon, 16 May 2016 21:33:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-the-timestamp-format-to-YYYY-MM-DD/m-p/248673#M47861 dennisaraujo 2016-05-16T21:33:03Z