topic Re: Time field extraction in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction/m-p/537242#M90051 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206557">@pankajupadhyay</a>,</P><P>probably Splunk cannot correctly recognize timestamps, so you have to give to Splunk some additional information, for a sourcetype:</P><UL><LI>TIME_FORMAT</LI><LI>TIME_PREFIX</LI><LI>MAX_TIMESTAMP_LOOKAHEAD</LI><LI>etc...</LI></UL><P>you can find more infos at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Configuretimestamprecognition" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Configuretimestamprecognition</A></P><P>If you share some sample of your data I could help you in this job.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 26 Jan 2021 16:35:36 GMT gcusello 2021-01-26T16:35:36Z Time field extraction https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction/m-p/537238#M90050 <P>Hi,</P><P>How we can extract time from the log event and then index ?</P><P>As Splunk shows different time stamp on indexer but time stamp in log event are different.</P><P>&nbsp;</P><P>Please help.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 26 Jan 2021 16:06:48 GMT https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction/m-p/537238#M90050 pankajupadhyay 2021-01-26T16:06:48Z Re: Time field extraction https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction/m-p/537242#M90051 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206557">@pankajupadhyay</a>,</P><P>probably Splunk cannot correctly recognize timestamps, so you have to give to Splunk some additional information, for a sourcetype:</P><UL><LI>TIME_FORMAT</LI><LI>TIME_PREFIX</LI><LI>MAX_TIMESTAMP_LOOKAHEAD</LI><LI>etc...</LI></UL><P>you can find more infos at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Configuretimestamprecognition" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Configuretimestamprecognition</A></P><P>If you share some sample of your data I could help you in this job.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 26 Jan 2021 16:35:36 GMT https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction/m-p/537242#M90051 gcusello 2021-01-26T16:35:36Z