topic Props not considering AM PM in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Props-not-considering-AM-PM/m-p/485170#M83049 <P>Splunk Props is not considering AM PM. <STRONG>Need to consider AM PM value and convert the time into 24 hour time format</STRONG> for the below sample log.</P> <P>Log Sample: </P> <P>5465465||TEXT||546546545445|65465|TEXT|TEXT|TEXT|TEXT|||0||TEXT||TEXT||||||||TEXT||13-JAN-20 06.09.59.000000 PM|||||||||||||||</P> <P>Existing Props configuration: </P> <P>DATETIME_CONFIG =<BR /> FIELD_DELIMITER = |<BR /> INDEXED_EXTRACTIONS = csv<BR /> KV_MODE = none<BR /> NO_BINARY_CHECK = true<BR /> SHOULD_LINEMERGE = false<BR /> TIMESTAMP_FIELDS = "Field name where time is exist with am/pm"<BR /> category = Structured<BR /> disabled = false<BR /> pulldown_type = true</P> Wed, 30 Sep 2020 03:42:01 GMT ahmadshakir1952 2020-09-30T03:42:01Z Props not considering AM PM https://community.splunk.com/t5/Getting-Data-In/Props-not-considering-AM-PM/m-p/485170#M83049 <P>Splunk Props is not considering AM PM. <STRONG>Need to consider AM PM value and convert the time into 24 hour time format</STRONG> for the below sample log.</P> <P>Log Sample: </P> <P>5465465||TEXT||546546545445|65465|TEXT|TEXT|TEXT|TEXT|||0||TEXT||TEXT||||||||TEXT||13-JAN-20 06.09.59.000000 PM|||||||||||||||</P> <P>Existing Props configuration: </P> <P>DATETIME_CONFIG =<BR /> FIELD_DELIMITER = |<BR /> INDEXED_EXTRACTIONS = csv<BR /> KV_MODE = none<BR /> NO_BINARY_CHECK = true<BR /> SHOULD_LINEMERGE = false<BR /> TIMESTAMP_FIELDS = "Field name where time is exist with am/pm"<BR /> category = Structured<BR /> disabled = false<BR /> pulldown_type = true</P> Wed, 30 Sep 2020 03:42:01 GMT https://community.splunk.com/t5/Getting-Data-In/Props-not-considering-AM-PM/m-p/485170#M83049 ahmadshakir1952 2020-09-30T03:42:01Z Re: Props not considering AM PM https://community.splunk.com/t5/Getting-Data-In/Props-not-considering-AM-PM/m-p/485171#M83050 <P>Try telling Splunk what the timestamp field looks like.</P> <PRE><CODE>TIME_FORMAT = %d-%b-%y %I.%M.%S.%6N %p </CODE></PRE> Mon, 20 Jan 2020 12:42:03 GMT https://community.splunk.com/t5/Getting-Data-In/Props-not-considering-AM-PM/m-p/485171#M83050 richgalloway 2020-01-20T12:42:03Z