https://community.splunk.com/t5/Getting-Data-In/How-to-setup-TIME-FORMAT-with-time-and-date-in-separate/m-p/288706#M55160 <P>I get trouble to setup TIME_FORMAT= ????, the documents help only if Date and time is in one line.</P> <P>In my case : The log file is generateted from 00:00 to 23:59 date is 032318 in Filename.<BR /> on time format i get for each line in this log file timestamp but not date !<BR /> I need methode to move the Date from the filename to the TIME_FORMAT extraction for index all line with date and time.<BR /> sample : filesname : xxxx.020918_00004.log here we have the date only<BR /> The have starting line like : 13:00:11.588 [5636.5636] ...... here are the time stamps from 00:00 to 23:59 for each day<BR /> There no date in the file!<BR /> how do need to define the TIME_FORMATE in props.conf for this case ?<BR /> TIME_FORMAT= %H:%M:%S ..... missing the DATE ? for correct indexing<BR /> this is a question about application NETbackup from Veritas and his logs<BR /> on files in /usr/openv/netbackup/logs &gt;&gt;&gt; date in logfilename &gt;&gt; time in logfile<BR /> on files in /usr/openv/logs &gt;&gt; we have unixtime time and date in log file this no proplem !</P> <P>Thank in advanced,</P> <P>Darius</P> Tue, 29 Sep 2020 18:41:04 GMT winicd 2020-09-29T18:41:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-TIME-FORMAT-with-time-and-date-in-separate/m-p/288706#M55160 <P>I get trouble to setup TIME_FORMAT= ????, the documents help only if Date and time is in one line.</P> <P>In my case : The log file is generateted from 00:00 to 23:59 date is 032318 in Filename.<BR /> on time format i get for each line in this log file timestamp but not date !<BR /> I need methode to move the Date from the filename to the TIME_FORMAT extraction for index all line with date and time.<BR /> sample : filesname : xxxx.020918_00004.log here we have the date only<BR /> The have starting line like : 13:00:11.588 [5636.5636] ...... here are the time stamps from 00:00 to 23:59 for each day<BR /> There no date in the file!<BR /> how do need to define the TIME_FORMATE in props.conf for this case ?<BR /> TIME_FORMAT= %H:%M:%S ..... missing the DATE ? for correct indexing<BR /> this is a question about application NETbackup from Veritas and his logs<BR /> on files in /usr/openv/netbackup/logs &gt;&gt;&gt; date in logfilename &gt;&gt; time in logfile<BR /> on files in /usr/openv/logs &gt;&gt; we have unixtime time and date in log file this no proplem !</P> <P>Thank in advanced,</P> <P>Darius</P> Tue, 29 Sep 2020 18:41:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-TIME-FORMAT-with-time-and-date-in-separate/m-p/288706#M55160 winicd 2020-09-29T18:41:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-TIME-FORMAT-with-time-and-date-in-separate/m-p/288707#M55161 <P>If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)<BR /> For file sources, if no date can be identified in the file name, Splunk software uses the file modification time.<BR /> As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.</P> <P>In general I would just define TIME_FORMAT as H:M:S.%3N in this case.<BR /> What happens when you try it with a sample?<BR /> I have done a few times and every time splunk was able to pick up the date from the file name.</P> Sun, 25 Mar 2018 13:59:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-TIME-FORMAT-with-time-and-date-in-separate/m-p/288707#M55161 Azeemering 2018-03-25T13:59:39Z