https://community.splunk.com/t5/Getting-Data-In/Timestamp-help/m-p/95623#M97442 <P>Hi </P> <P>I have two time stamps in my logs. .</P> <P>say <STRONG><TIME>12:10:2012T05:40:34+1.00<A href="https://answers.splunk.comL:TIME">/L:TIME</A></TIME></STRONG> and <STRONG>TIMESTAMP=2012-07-11T06:59:00.008+01:00</STRONG> ..</P> <P>How can i say splunk to take one of time as <STRONG>_time</STRONG> . i need the TIMESTAMP to be taken as my loggig event time..so that i can calucate the difference between the events with the help of transacition command...</P> <P>Please help..</P> Wed, 11 Jul 2012 10:36:14 GMT rakesh_498115 2012-07-11T10:36:14Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-help/m-p/95623#M97442 <P>Hi </P> <P>I have two time stamps in my logs. .</P> <P>say <STRONG><TIME>12:10:2012T05:40:34+1.00<A href="https://answers.splunk.comL:TIME">/L:TIME</A></TIME></STRONG> and <STRONG>TIMESTAMP=2012-07-11T06:59:00.008+01:00</STRONG> ..</P> <P>How can i say splunk to take one of time as <STRONG>_time</STRONG> . i need the TIMESTAMP to be taken as my loggig event time..so that i can calucate the difference between the events with the help of transacition command...</P> <P>Please help..</P> Wed, 11 Jul 2012 10:36:14 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-help/m-p/95623#M97442 rakesh_498115 2012-07-11T10:36:14Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-help/m-p/95624#M97443 <P>You need to set the <CODE>TIME_PREFIX</CODE> in props.conf.</P> <PRE><CODE>[yoursourcetype] TIME_PREFIX = TIMESTAMP= </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf</A></P> Wed, 11 Jul 2012 11:47:01 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-help/m-p/95624#M97443 Ayn 2012-07-11T11:47:01Z