https://community.splunk.com/t5/Getting-Data-In/Change-timestamp-and-making-it-effective/m-p/48289#M9134 <P>Hi,<BR /> I'm trying to redefine the timestamp for my resource that contains data as follows:</P> <PRE><CODE>DBInit-27,21/02/2013 9:28:26,22/02/2013 16:30:16,0,R_1812,0,Netscape3.0,0,0,3,172.21.0.132,172.21.0.132,ohm-web-7.9.0-SNAPSHOT (6f5d6 - 2013-02-26 13:58:14),20130301_110723,1/03/2013 11:12:38,1/03/2013 11:12:45,7,True,DAVIDJ-3500,x86,4 </CODE></PRE> <P>By default, the timestamp that is extracted is the first one that it encounters, being <CODE>21/02/2013 9:28:26</CODE> in this case. However, I want to make the timestamp to be <CODE>1/03/2013 11:12:38</CODE> (the one before the last timestamp). For this, I added the following in <CODE>C:\Program Files\Splunk\etc\apps\search\default\props.conf</CODE>:</P> <P><CODE>[source::C:\\Temp\\testResultLog.csv]<BR /> TIME_PREFIX = \d{8}_\d{6},<BR /> TIME_FORMAT = %d/%m/%y %H:%M:%S<BR /> </CODE></P> <P>The regex matches <CODE>20130301_110723,</CODE> expecting to define the timestamp as I desire, as is explained in the manual.<BR /> Unfortunately, this has no effect; I tried to stop and start splunk; did a <CODE>source="C:\\Temp\\testResultLog.csv" | extract reload=T</CODE>; all to no effect ..</P> <P>Thanks!</P> Fri, 01 Mar 2013 13:59:19 GMT davidjehoul 2013-03-01T13:59:19Z https://community.splunk.com/t5/Getting-Data-In/Change-timestamp-and-making-it-effective/m-p/48289#M9134 <P>Hi,<BR /> I'm trying to redefine the timestamp for my resource that contains data as follows:</P> <PRE><CODE>DBInit-27,21/02/2013 9:28:26,22/02/2013 16:30:16,0,R_1812,0,Netscape3.0,0,0,3,172.21.0.132,172.21.0.132,ohm-web-7.9.0-SNAPSHOT (6f5d6 - 2013-02-26 13:58:14),20130301_110723,1/03/2013 11:12:38,1/03/2013 11:12:45,7,True,DAVIDJ-3500,x86,4 </CODE></PRE> <P>By default, the timestamp that is extracted is the first one that it encounters, being <CODE>21/02/2013 9:28:26</CODE> in this case. However, I want to make the timestamp to be <CODE>1/03/2013 11:12:38</CODE> (the one before the last timestamp). For this, I added the following in <CODE>C:\Program Files\Splunk\etc\apps\search\default\props.conf</CODE>:</P> <P><CODE>[source::C:\\Temp\\testResultLog.csv]<BR /> TIME_PREFIX = \d{8}_\d{6},<BR /> TIME_FORMAT = %d/%m/%y %H:%M:%S<BR /> </CODE></P> <P>The regex matches <CODE>20130301_110723,</CODE> expecting to define the timestamp as I desire, as is explained in the manual.<BR /> Unfortunately, this has no effect; I tried to stop and start splunk; did a <CODE>source="C:\\Temp\\testResultLog.csv" | extract reload=T</CODE>; all to no effect ..</P> <P>Thanks!</P> Fri, 01 Mar 2013 13:59:19 GMT https://community.splunk.com/t5/Getting-Data-In/Change-timestamp-and-making-it-effective/m-p/48289#M9134 davidjehoul 2013-03-01T13:59:19Z https://community.splunk.com/t5/Getting-Data-In/Change-timestamp-and-making-it-effective/m-p/48290#M9135 <P>Timestamp extraction takes place at index-time, and as such changes to this will not apply to data that has already been indexed. You need to reindex your data.</P> Fri, 01 Mar 2013 14:11:24 GMT https://community.splunk.com/t5/Getting-Data-In/Change-timestamp-and-making-it-effective/m-p/48290#M9135 Ayn 2013-03-01T14:11:24Z