https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464273#M80064 <P>The minus sign is covered by <CODE>%z</CODE> so all you need is <CODE>TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z</CODE>.</P> Wed, 11 Dec 2019 03:28:19 GMT richgalloway 2019-12-11T03:28:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464272#M80063 <P>My timestamp is appearing as such:</P> <PRE><CODE>2019-12-10T18:13:42-05:00 </CODE></PRE> <P>My props.conf file looks like this:</P> <PRE><CODE>TIME_FORMAT=%Y-%m-%dT%H:%M:%S-%:z </CODE></PRE> <P>Is this correct? Some of my indexes are presenting a really strange date compared to the time stamp but I think the devices they are coming from my be in a different TZ. My next question would be how to convert to EST. </P> Tue, 10 Dec 2019 23:53:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464272#M80063 bnichols024 2019-12-10T23:53:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464273#M80064 <P>The minus sign is covered by <CODE>%z</CODE> so all you need is <CODE>TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z</CODE>.</P> Wed, 11 Dec 2019 03:28:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464273#M80064 richgalloway 2019-12-11T03:28:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464274#M80065 <P>I would add use %F and %T, so %FT%T%:z</P> Mon, 23 Dec 2019 00:12:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-file-for-time-format/m-p/464274#M80065 twinspop 2019-12-23T00:12:31Z