https://community.splunk.com/t5/Getting-Data-In/Splunk-props-conf/m-p/370585#M67296 <P>Hi yanivdutt,<BR /> what are %T and %L?<BR /> try with </P> <PRE><CODE>TIME_FORMAT=%H:%M:%S,%3N </CODE></PRE> <P>I suggest to extract a sample from your logs and use the web guided log ingestion, so you can immediately test your props.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 26 Jun 2017 06:32:53 GMT gcusello 2017-06-26T06:32:53Z https://community.splunk.com/t5/Getting-Data-In/Splunk-props-conf/m-p/370584#M67295 <P>Hi,<BR /> My logs are not breaking correctly. Below is sample logs</P> <P>16:40:13,732 INFO <A href="https://community.splunk.com/http-thread-pool-331" target="_blank">web</A> Redeemed promotion=BI_500_POINTS for usa_id=2300000032458812 channel=OMS amount=500.0 offerId=2536374313674604550 termId=null dateSk=7484 locationSk=550 isCancel=true tier=ROUGE<BR /> 16:40:13,747 INFO <A href="https://community.splunk.com/http-thread-pool-10" target="_blank">web</A> Redeemed promotion=ROUGE_WELCOME_KIT for usa_id=2253998837903414 channel=atg amount=-0.0 offerId=3000000000000000001 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE<BR /> 16:40:13,748 INFO <A href="https://community.splunk.com/http-thread-pool-10" target="_blank">web</A> Redeemed promotion=BI_100_POINTS for usa_id=2253998837903414 channel=atg amount=-100.0 offerId=2536374313674604552 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE<BR /> 16:40:29,553 INFO <A href="https://community.splunk.com/http-thread-pool-10" target="_blank">web</A> Redeemed promotion=BD_GIFT for usa_id=2300000038257945 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=550 isCancel=false tier=BI<BR /> 16:40:54,421 INFO <A href="https://community.splunk.com/http-thread-pool-395" target="_blank">web</A> Redeemed promotion=BD_GIFT for usa_id=2300000045716715 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=2492 isCancel=false tier=ROUGE<BR /> 16:40:58,121 INFO <A href="https://community.splunk.com/http-thread-pool-320" target="_blank">web</A> Redeemed promotion=VIB_WK for usa_id=2300000026110754 channel=pos amount=-0.0 offerId=2536374313674604555 termId=null dateSk=7484 locationSk=341 isCancel=false tier=BI</P> <P>I tried <BR /> [web]<BR /> TIME_FORMAT=%T,%L<BR /> SHOULD_LINEMERGE=false</P> Tue, 29 Sep 2020 14:39:09 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-props-conf/m-p/370584#M67295 yanivdutt 2020-09-29T14:39:09Z https://community.splunk.com/t5/Getting-Data-In/Splunk-props-conf/m-p/370585#M67296 <P>Hi yanivdutt,<BR /> what are %T and %L?<BR /> try with </P> <PRE><CODE>TIME_FORMAT=%H:%M:%S,%3N </CODE></PRE> <P>I suggest to extract a sample from your logs and use the web guided log ingestion, so you can immediately test your props.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 26 Jun 2017 06:32:53 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-props-conf/m-p/370585#M67296 gcusello 2017-06-26T06:32:53Z