https://community.splunk.com/t5/Getting-Data-In/How-Do-I-get-Splunk-to-Recognize-a-Log-TimeStamp-and-Convert-it/m-p/278806#M53364 <P>Use this</P> <PRE><CODE>TIME_FORMAT=%Y%m%d/%H%M%S.%3N TIME_PREFEX=set as per your log MAX_TIMESTAMP_LOOKAHEAD=17 </CODE></PRE> Thu, 02 Jun 2016 16:06:26 GMT somesoni2 2016-06-02T16:06:26Z https://community.splunk.com/t5/Getting-Data-In/How-Do-I-get-Splunk-to-Recognize-a-Log-TimeStamp-and-Convert-it/m-p/278805#M53363 <P>I have log data that has a timestamp in this format <CODE>20160530/001020.670</CODE></P> <P>I uploaded the log directly into Splunk to test with and Splunk is ignoring the timestamp and assigning it's own timestamp which does not match the log data. </P> <P>I cleared the data from that index and re-uploaded the data and currently on the 'Set Sourcetype' step. There's a section labeled 'Timestamp' which has 'Timestamp format' , 'Timestamp prefix' , and 'Lookahead'.. </P> <P><STRONG>My question</STRONG> </P> <P>How can I get Splunk to recognize the timestamp <CODE>20160530/001020.670</CODE> and convert it to <CODE>5/30/16 12:10:20.670 AM</CODE>?</P> Thu, 02 Jun 2016 15:59:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-Do-I-get-Splunk-to-Recognize-a-Log-TimeStamp-and-Convert-it/m-p/278805#M53363 skoelpin 2016-06-02T15:59:48Z https://community.splunk.com/t5/Getting-Data-In/How-Do-I-get-Splunk-to-Recognize-a-Log-TimeStamp-and-Convert-it/m-p/278806#M53364 <P>Use this</P> <PRE><CODE>TIME_FORMAT=%Y%m%d/%H%M%S.%3N TIME_PREFEX=set as per your log MAX_TIMESTAMP_LOOKAHEAD=17 </CODE></PRE> Thu, 02 Jun 2016 16:06:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-Do-I-get-Splunk-to-Recognize-a-Log-TimeStamp-and-Convert-it/m-p/278806#M53364 somesoni2 2016-06-02T16:06:26Z