https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495896#M99950 <P>Please share ALL of the props.conf settings for the sourcetype. Please also share a sample of the CSV file.</P> Mon, 11 May 2020 14:11:33 GMT richgalloway 2020-05-11T14:11:33Z https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495894#M99948 <P>I have a date like May 10 2020 11:20 PM in csv file</P> <P>Defined in props.conf <BR /> TIME_FORMAT - %b %d %Y %I:%M %p</P> <P>but getting "Failed to parse timestamp"</P> <P>what I am missing ? </P> Mon, 11 May 2020 12:40:32 GMT https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495894#M99948 rayar 2020-05-11T12:40:32Z https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495895#M99949 <PRE><CODE>| makeresults | eval _raw="May 10 2020 11:20 PM" | eval _time=strptime(_raw,"%b %d %Y %I:%M %p") </CODE></PRE> <P><CODE>TIME_FORMAT</CODE> is good.<BR /> maybe, timestamp recognition is bad.</P> Mon, 11 May 2020 12:55:51 GMT https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495895#M99949 to4kawa 2020-05-11T12:55:51Z https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495896#M99950 <P>Please share ALL of the props.conf settings for the sourcetype. Please also share a sample of the CSV file.</P> Mon, 11 May 2020 14:11:33 GMT https://community.splunk.com/t5/Getting-Data-In/TIME%D6%B9%D6%B9-FORMAT-configuration/m-p/495896#M99950 richgalloway 2020-05-11T14:11:33Z