topic Re: Help me write my props.con for this log? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Help-me-write-my-props-con-for-this-log/m-p/473064#M99692 <P>can you try this </P> <P>[your_sourcetype]<BR /> TIME_PREFIX=\d+.\d+.\d+.\d+\s\w+\s<BR /> TIME_FORMAT=%s.%2N</P> Wed, 30 Sep 2020 02:06:14 GMT rupesh26 2020-09-30T02:06:14Z Help me write my props.con for this log? https://community.splunk.com/t5/Getting-Data-In/Help-me-write-my-props-con-for-this-log/m-p/473063#M99691 <P>All, </P> <P>I have a log that looks like this? UTC time. What would my props.conf for this look like for that EPOCH timestamp? </P> <P>system server.domain.com 192.168.1.11 start 1567632918.94<BR /> system server.domain.com 192.168.1.11 stop 1567632918.94</P> Thu, 05 Sep 2019 19:24:24 GMT https://community.splunk.com/t5/Getting-Data-In/Help-me-write-my-props-con-for-this-log/m-p/473063#M99691 daniel333 2019-09-05T19:24:24Z Re: Help me write my props.con for this log? https://community.splunk.com/t5/Getting-Data-In/Help-me-write-my-props-con-for-this-log/m-p/473064#M99692 <P>can you try this </P> <P>[your_sourcetype]<BR /> TIME_PREFIX=\d+.\d+.\d+.\d+\s\w+\s<BR /> TIME_FORMAT=%s.%2N</P> Wed, 30 Sep 2020 02:06:14 GMT https://community.splunk.com/t5/Getting-Data-In/Help-me-write-my-props-con-for-this-log/m-p/473064#M99692 rupesh26 2020-09-30T02:06:14Z