<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Timestamp recognition when date appears once but time appears on every line in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Timestamp-recognition-when-date-appears-once-but-time-appears-on/m-p/539674#M90399</link>
    <description>&lt;P&gt;Hi, I can't seem to work out how to do this. I've looked in the documentation but can't find an example. I am trying to set up date/time recognition for a log file that has the date only on the first line of the log file and then every entry thereafter has the time. Here is an example:&lt;/P&gt;&lt;LI-CODE lang="c"&gt;Logfile name xxxxx Current Day: 01/30/2021

(13:11:06.696)(07059)ABCDEF_01: TX (000)162,47773,455,0538,126,00152,00174|00000
(13:11:07.324)(07060)ABCDEF_01: RX (000)162,47773,455,0538,126,00152,00174|00000&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;How do I define the extraction so every event has the date 01/30/2021 and then the time of the event is taken from every line as&amp;nbsp;H:%M:%S.%3N %Z&lt;/P&gt;</description>
    <pubDate>Fri, 12 Feb 2021 12:11:54 GMT</pubDate>
    <dc:creator>jbesant</dc:creator>
    <dc:date>2021-02-12T12:11:54Z</dc:date>
    <item>
      <title>Timestamp recognition when date appears once but time appears on every line</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Timestamp-recognition-when-date-appears-once-but-time-appears-on/m-p/539674#M90399</link>
      <description>&lt;P&gt;Hi, I can't seem to work out how to do this. I've looked in the documentation but can't find an example. I am trying to set up date/time recognition for a log file that has the date only on the first line of the log file and then every entry thereafter has the time. Here is an example:&lt;/P&gt;&lt;LI-CODE lang="c"&gt;Logfile name xxxxx Current Day: 01/30/2021

(13:11:06.696)(07059)ABCDEF_01: TX (000)162,47773,455,0538,126,00152,00174|00000
(13:11:07.324)(07060)ABCDEF_01: RX (000)162,47773,455,0538,126,00152,00174|00000&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;How do I define the extraction so every event has the date 01/30/2021 and then the time of the event is taken from every line as&amp;nbsp;H:%M:%S.%3N %Z&lt;/P&gt;</description>
      <pubDate>Fri, 12 Feb 2021 12:11:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Timestamp-recognition-when-date-appears-once-but-time-appears-on/m-p/539674#M90399</guid>
      <dc:creator>jbesant</dc:creator>
      <dc:date>2021-02-12T12:11:54Z</dc:date>
    </item>
  </channel>
</rss>

