https://community.splunk.com/t5/Getting-Data-In/How-to-write-the-extract-the-timestamp-from-my-sample-event-in/m-p/339554#M62675 <P>Add these to your props.conf</P> <PRE><CODE>[yoursourcetype] ....other line breaking stuffs... TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 </CODE></PRE> Fri, 03 Mar 2017 16:28:29 GMT somesoni2 2017-03-03T16:28:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-the-extract-the-timestamp-from-my-sample-event-in/m-p/339553#M62674 <P>How to write the extract the timestamp from the following event in props.conf?</P> <P>Mar 3 15:16:10 servername user:info syslog.........</P> Fri, 03 Mar 2017 15:58:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-the-extract-the-timestamp-from-my-sample-event-in/m-p/339553#M62674 sreejith2k2 2017-03-03T15:58:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-the-extract-the-timestamp-from-my-sample-event-in/m-p/339554#M62675 <P>Add these to your props.conf</P> <PRE><CODE>[yoursourcetype] ....other line breaking stuffs... TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 </CODE></PRE> Fri, 03 Mar 2017 16:28:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-the-extract-the-timestamp-from-my-sample-event-in/m-p/339554#M62675 somesoni2 2017-03-03T16:28:29Z