https://community.splunk.com/t5/Getting-Data-In/Script/m-p/546896#M91061 <P>Hello Guys,</P><P>I want one as shell script in which i want to extract only sourcetype name and TIME_FORMAT attribute from the props.conf. I tried to extract but some how it is not exactly extracting the results.</P><P>&nbsp;</P><P>ls l grep 'TIME_FORM*' props.conf | awk '{print $0}' | sed 's/E_FORMAT=/ /</P><P>I tried for timeformat but i want sourcetype ne and its respective timeformat.Can anyone suggest this.</P><P>&nbsp;</P> Tue, 06 Apr 2021 16:27:18 GMT uagraw01 2021-04-06T16:27:18Z https://community.splunk.com/t5/Getting-Data-In/Script/m-p/546896#M91061 <P>Hello Guys,</P><P>I want one as shell script in which i want to extract only sourcetype name and TIME_FORMAT attribute from the props.conf. I tried to extract but some how it is not exactly extracting the results.</P><P>&nbsp;</P><P>ls l grep 'TIME_FORM*' props.conf | awk '{print $0}' | sed 's/E_FORMAT=/ /</P><P>I tried for timeformat but i want sourcetype ne and its respective timeformat.Can anyone suggest this.</P><P>&nbsp;</P> Tue, 06 Apr 2021 16:27:18 GMT https://community.splunk.com/t5/Getting-Data-In/Script/m-p/546896#M91061 uagraw01 2021-04-06T16:27:18Z https://community.splunk.com/t5/Getting-Data-In/Script/m-p/546897#M91062 <P><SPAN>ls l grep 'TIME_FORM*' props.conf | awk '{print $0}' | sed 's/TIME_FORMAT=/ /g'</SPAN></P><P><SPAN>&nbsp;</SPAN></P><P><SPAN>&nbsp;</SPAN></P> Tue, 06 Apr 2021 16:28:36 GMT https://community.splunk.com/t5/Getting-Data-In/Script/m-p/546897#M91062 uagraw01 2021-04-06T16:28:36Z