https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182160#M98379 <P>Hello,<BR /> Please try this.</P> <PRE><CODE>[icm_data] EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?" BREAK_ONLY_BEFORE_DATE = true MAX_TIMESTAMP_LOOKAHEAD = 50 TIME_FORMAT = %m/%d/%Y %H:%M:%S BREAK_ONLY_BEFORE = timestamp MAX_DAYS_AGO = 5000 SHOULD_LINEMERGE= false </CODE></PRE> <P>Thanks</P> Tue, 11 Mar 2014 19:59:23 GMT linu1988 2014-03-11T19:59:23Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182159#M98378 <P>Hi all,</P> <P>I am streaming TCP data into splunk which comes in the format of this.</P> <PRE><CODE>timestamp="09/15/2008 21:16:46" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2056" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2261" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" timestamp="09/15/2008 21:16:47" path="//depot/XX/proj/XX/dev/opus/XX/cdsinfo.tag" rev="1" action="add" file_size="43" type="text" change="2058" user="icmAdmin" description="nde XX T:opus A:Created" client="172_17_12_140~pm~2284" status="submitted" file="cdsinfo.tag" ext="tag" project="XX" variant="dev" library_type="opus" </CODE></PRE> <P>But when I'm looking at the data in Splunk it's not parsing the Time correctly. It's using the Time (column) it was uploaded as opposed to the timestamp which is what I want. This is some historical data that we want to parse out.</P> <P>Now I thought I would need to create a props.conf in my (otherwise empty) project which I did and I did notice a slight change but I can't get the timestamp field to set the time..</P> <P>Here is the contents of my current prop.conf.</P> <PRE><CODE>[icm_data] EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?" BREAK_ONLY_BEFORE_DATE = true MAX_TIMESTAMP_LOOKAHEAD = 50 TIME_FORMAT = %m/%d/%Y %H:%M:%S LINE_BREAKER = [\r\n] SHOULD_LINEMERGE= false MAX_EVENTS=1 </CODE></PRE> <P>Can someone show me the errors I'm creating? Thanks!!</P> Tue, 11 Mar 2014 19:04:16 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182159#M98378 sklass 2014-03-11T19:04:16Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182160#M98379 <P>Hello,<BR /> Please try this.</P> <PRE><CODE>[icm_data] EXTRACT-ICMP4 Quoted KV = ([A-Za-z\-\_]+)="([a-zA-Z0-9\/\:\.\_\-\~ ]+)?" BREAK_ONLY_BEFORE_DATE = true MAX_TIMESTAMP_LOOKAHEAD = 50 TIME_FORMAT = %m/%d/%Y %H:%M:%S BREAK_ONLY_BEFORE = timestamp MAX_DAYS_AGO = 5000 SHOULD_LINEMERGE= false </CODE></PRE> <P>Thanks</P> Tue, 11 Mar 2014 19:59:23 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182160#M98379 linu1988 2014-03-11T19:59:23Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182161#M98380 <P>Hi there - Hey thanks - It's still not working. Can you explain two things:<BR /> - <EM>If you see some other year it takes the year.</EM><BR /> - <EM>need to check in datetime.xml file in etc folder</EM></P> Tue, 11 Mar 2014 20:14:20 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182161#M98380 sklass 2014-03-11T20:14:20Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182162#M98381 <P>updated the answer try this..</P> Tue, 11 Mar 2014 21:25:22 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-time-the-event-occured/m-p/182162#M98381 linu1988 2014-03-11T21:25:22Z