https://community.splunk.com/t5/Getting-Data-In/How-to-get-date-and-time-from-this-format/m-p/335170#M61998 <P>Give this a try (props.conf on your indexer/heavy forwarder)</P> <PRE><CODE>[yoursourcetype] ....other line breaking stuffs... TIME_PREFIX = \[ TIME_FORMAT = %Y/%m/%d@%H:%M:%S.%3N%z MAX_TIMESTAMP_LOOKAHEAD = 28 </CODE></PRE> Fri, 03 Mar 2017 16:30:28 GMT somesoni2 2017-03-03T16:30:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-date-and-time-from-this-format/m-p/335169#M61997 <P>I have date and time in this format,</P> <P>[2010/01/14@08:43:17.561+0100]</P> <P>How to read it correctly into Splunk?</P> Fri, 03 Mar 2017 15:09:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-date-and-time-from-this-format/m-p/335169#M61997 mdzmuran 2017-03-03T15:09:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-date-and-time-from-this-format/m-p/335170#M61998 <P>Give this a try (props.conf on your indexer/heavy forwarder)</P> <PRE><CODE>[yoursourcetype] ....other line breaking stuffs... TIME_PREFIX = \[ TIME_FORMAT = %Y/%m/%d@%H:%M:%S.%3N%z MAX_TIMESTAMP_LOOKAHEAD = 28 </CODE></PRE> Fri, 03 Mar 2017 16:30:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-date-and-time-from-this-format/m-p/335170#M61998 somesoni2 2017-03-03T16:30:28Z