https://community.splunk.com/t5/Getting-Data-In/How-to-transform-multiple-timestamps-in-an-event/m-p/486574#M83331 <P>Hi MOHITJOSHI,</P> <P>try this in props.conf for that sourcetype:</P> <PRE><CODE>[YourSourcetypeNameHere] TIME_PREFIX = ZZZ- TIME_FORMAT = %Y%m%d-%H:%M:%S- </CODE></PRE> <P>Save this on the first full Splunk instance that receives the events and restart the instance, any new incoming events should have the second timestamp as their <CODE>_time</CODE> field.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 18 Nov 2019 19:27:15 GMT MuS 2019-11-18T19:27:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-transform-multiple-timestamps-in-an-event/m-p/486573#M83330 <P>I have an event that prints the actual time which Splunk metadata has, but instead, I want to use the other timestamp.<BR /> Splunk time shows 8/15/18<BR /> 2:12:44.000 PM which it extracts from the Verbose line but I am interested to use the ZZZ-20190802-13:18:06-0000000001-3820-0 so that my Splunk time is based on ZZZ field</P> <P>VERBOSE abc 08/15/18 18:12:44 xyz<BR /> DETAILS abc123 0.594s abc: 0.336s :abc: 0.001s ZZZ-20190802-13:18:06-0000000001-3820-0</P> Mon, 18 Nov 2019 18:44:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transform-multiple-timestamps-in-an-event/m-p/486573#M83330 MOHITJOSHI 2019-11-18T18:44:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-transform-multiple-timestamps-in-an-event/m-p/486574#M83331 <P>Hi MOHITJOSHI,</P> <P>try this in props.conf for that sourcetype:</P> <PRE><CODE>[YourSourcetypeNameHere] TIME_PREFIX = ZZZ- TIME_FORMAT = %Y%m%d-%H:%M:%S- </CODE></PRE> <P>Save this on the first full Splunk instance that receives the events and restart the instance, any new incoming events should have the second timestamp as their <CODE>_time</CODE> field.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Mon, 18 Nov 2019 19:27:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transform-multiple-timestamps-in-an-event/m-p/486574#M83331 MuS 2019-11-18T19:27:15Z