https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270164#M51866 <P>%m/%d/%y, %I:%M %p</P> Fri, 09 Dec 2016 20:05:03 GMT sravankaripe 2016-12-09T20:05:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270162#M51864 <P>i have a data like this:</P> <PRE><CODE> capturedTime = "12/6/16, 9:08 PM"; indymeDepartmentNumber = 250; lastCacheTime = "12/6/16, 12:00 AM"; storeNumber = 1520; vendorID = "4426E4B9-1658-438C-9890-6A01DB164189"; capturedTime = "12/6/16, 6:07 PM"; indymeDepartmentNumber = 250; lastCacheTime = "12/6/16, 12:00 AM"; storeNumber = 1520; vendorID = "4426E4B9-1658-438C-9890-6A01DB164189"; capturedTime = "12/6/16, 3:32 PM"; indymeDepartmentNumber = 250; lastCacheTime = "12/6/16, 12:00 AM"; storeNumber = 1520; vendorID = "4426E4B9-1658-438C-9890-6A01DB164189"; </CODE></PRE> <P>i need to retrieve time(capturedTime) from above data . please help me with the props</P> <P>TIME_FORMAT=<BR /> TIME_PREFIX=<BR /> BREAK_ONLY_BEFORE=</P> Tue, 29 Sep 2020 12:03:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270162#M51864 sravankaripe 2020-09-29T12:03:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270163#M51865 <PRE><CODE>TIME_FORMAT=%m/%d/%y, %H:%M %p TIME_PREFIX=" BREAK_ONLY_BEFORE=capturedTime </CODE></PRE> Fri, 09 Dec 2016 18:34:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270163#M51865 richgalloway 2016-12-09T18:34:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270164#M51866 <P>%m/%d/%y, %I:%M %p</P> Fri, 09 Dec 2016 20:05:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-props-conf-to-retrieve-time-from-my-data/m-p/270164#M51866 sravankaripe 2016-12-09T20:05:03Z