https://community.splunk.com/t5/Getting-Data-In/Why-is-timestamp-not-selecting-proper-field-in-syslog-data-after/m-p/503045#M85688 <P>Try removing the blank <CODE>DATETIME_CONFIG =</CODE> setting.</P> Tue, 10 Dec 2019 17:29:17 GMT FrankVl 2019-12-10T17:29:17Z https://community.splunk.com/t5/Getting-Data-In/Why-is-timestamp-not-selecting-proper-field-in-syslog-data-after/m-p/503044#M85687 <P>My data is from a command system that is being sent over UDP connection direct to the indexer. It sends data to Splunk every hour. <BR /> Data format is Month Date Time sent from command system, system name, 1, Logon Time<BR /> Examples<BR /> Dec 10 00:51:46 system.network.net 1 2019-12-10T00:51:19.188-06:00<BR /> Dec 9 10:58:25 system.netework.net 1 2019-12-09T10:58:23.793-06:00<BR /> Dec 9 22:38:38 system.network.net 1 2019-12-06T08:05:23.745-06:00</P> <P>I want to use Logon Time as the event time not the time it was received.<BR /><BR /> This used to work until I upgraded to 7.3.3 from 7.3.0 to fix the Y2K20 issue. </P> <P>props file contains <BR /> DATETIME_CONFIG = <BR /> LINE_BREAKER = ([\r\n]+)<BR /> NO_BINARY_CHECK = true<BR /> TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q%:z<BR /> TIME_PREFIX = \w+\s{1,}\d{1,}\s\d{2}:\d{2}:\d{2}\s\S+\s\d\s<BR /> category = Custom<BR /> disabled = false<BR /> MAX_TIMESTAMP_LOOKAHEAD = 256<BR /> TIMESTAMP_FIELDS = </P> <P>Any suggestions on what happened?</P> <P>Scott</P> Wed, 30 Sep 2020 03:18:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-timestamp-not-selecting-proper-field-in-syslog-data-after/m-p/503044#M85687 scottrunyon 2020-09-30T03:18:02Z https://community.splunk.com/t5/Getting-Data-In/Why-is-timestamp-not-selecting-proper-field-in-syslog-data-after/m-p/503045#M85688 <P>Try removing the blank <CODE>DATETIME_CONFIG =</CODE> setting.</P> Tue, 10 Dec 2019 17:29:17 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-timestamp-not-selecting-proper-field-in-syslog-data-after/m-p/503045#M85688 FrankVl 2019-12-10T17:29:17Z