https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295184#M56078 <P>Unrelated to the question, but also worth noting, the rest of the index-time coniguration for that sourcetype may look like:</P> <PRE><CODE>LINE_BREAKER = ([\n\r]+)\d{2}:\d{2}:\d{2},\d{3}\s SHOULD_LINEMERGE = false </CODE></PRE> <P>This will ensure you only get new events when the line starts with that timestamp.</P> Thu, 11 Jan 2018 15:06:17 GMT micahkemp 2018-01-11T15:06:17Z https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295182#M56076 <P>Hi Folks.</P> <P>Could you please help me write the Time_perfix and Time_format extraction for below events.</P> <P>07:22:50,932 INFO [Timer-5] impl.NotificationLogServiceImpl - [logBefore] - **** Entering the method **** com.monsanto.wms.service.tools.impl.NotificationLogServiceImpl.saveNotificationLog(com.monsanto.wms.persistence.model.NotificationLog,java.lang.Long)<BR /> 07:22:50,932 INFO [Timer-5] impl.AlertTypeServiceImpl - [logBefore] - **** Entering the method **** com.monsanto.wms.service.tools.impl.AlertTypeServiceImpl.findById(java.lang.Long)</P> Tue, 29 Sep 2020 17:33:08 GMT https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295182#M56076 lksridhar 2020-09-29T17:33:08Z https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295183#M56077 <P>hey @Iksridhar<BR /> Please find below TIME_FORMAT and TIME_PREFIX extractions</P> <PRE><CODE>TIME_FORMAT = %H:%M:%S,%3N TIME_PREFIX = ^ </CODE></PRE> <P>Let me know if this helps you!</P> Tue, 29 Sep 2020 17:33:11 GMT https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295183#M56077 mayurr98 2020-09-29T17:33:11Z https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295184#M56078 <P>Unrelated to the question, but also worth noting, the rest of the index-time coniguration for that sourcetype may look like:</P> <PRE><CODE>LINE_BREAKER = ([\n\r]+)\d{2}:\d{2}:\d{2},\d{3}\s SHOULD_LINEMERGE = false </CODE></PRE> <P>This will ensure you only get new events when the line starts with that timestamp.</P> Thu, 11 Jan 2018 15:06:17 GMT https://community.splunk.com/t5/Getting-Data-In/Could-you-please-help-me-write-the-timestamp-extraction-for/m-p/295184#M56078 micahkemp 2018-01-11T15:06:17Z