https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307388#M57889 <P>See this article. It is probably all you need:</P> <P><A href="https://www.splunk.com/blog/2014/04/23/its-that-time-again.html">https://www.splunk.com/blog/2014/04/23/its-that-time-again.html</A></P> Fri, 14 Jul 2017 14:59:25 GMT cpetterborg 2017-07-14T14:59:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307386#M57887 <P>Hi,</P> <P>I have a series of devices coming into a syslog server. The format for the devices is as follows:</P> <P>3 different formats:<BR /> mm/dd/hh:mm:ss<BR /> hh:mm:ss<BR /> d h</P> <P>How do I configure timestamp formats for this if they are all the same sourcetype?</P> <P>Thanks </P> Fri, 14 Jul 2017 14:41:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307386#M57887 mwdbhyat 2017-07-14T14:41:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307387#M57888 <P>Hi mwdbhyat,<BR /> try using the default sourcetype recognition, you can test it downloading an example of each one of your logs and trying to ingest using web interface.<BR /> If this methid doesn't recognize your logs, you have to use different sourcetypes for each one.<BR /> Bye.<BR /> Giuseppe</P> Fri, 14 Jul 2017 14:58:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307387#M57888 gcusello 2017-07-14T14:58:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307388#M57889 <P>See this article. It is probably all you need:</P> <P><A href="https://www.splunk.com/blog/2014/04/23/its-that-time-again.html">https://www.splunk.com/blog/2014/04/23/its-that-time-again.html</A></P> Fri, 14 Jul 2017 14:59:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307388#M57889 cpetterborg 2017-07-14T14:59:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307389#M57890 <P>Thanks for that!</P> Fri, 14 Jul 2017 15:09:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307389#M57890 mwdbhyat 2017-07-14T15:09:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307390#M57891 <P>Another here:<BR /> <A href="https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem">https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem</A></P> Sat, 15 Jul 2017 20:25:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-multiple-timeformats/m-p/307390#M57891 woodcock 2017-07-15T20:25:43Z