https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348805#M103246 <P>if you to extract this as your event time then put below in props.conf</P> <PRE><CODE>[your_sourcetype] TIME_PREFIX = TransactionStartTime= TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N </CODE></PRE> <P>If you want to extract it in a field called "TransactionStartTime"</P> <PRE><CODE>index=your_index | rex field=_raw "TransactionStartTime=(?P&lt;TransactionStartTime&gt;\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3})" </CODE></PRE> <P>Let me know if this helps!</P> Tue, 19 Dec 2017 06:49:26 GMT mayurr98 2017-12-19T06:49:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348804#M103245 <P>How to extract time format using rex ?</P> <P>TransactionStartTime=12/19/2017 06:23:35.474;</P> Tue, 19 Dec 2017 06:30:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348804#M103245 karthi2809 2017-12-19T06:30:25Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348805#M103246 <P>if you to extract this as your event time then put below in props.conf</P> <PRE><CODE>[your_sourcetype] TIME_PREFIX = TransactionStartTime= TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N </CODE></PRE> <P>If you want to extract it in a field called "TransactionStartTime"</P> <PRE><CODE>index=your_index | rex field=_raw "TransactionStartTime=(?P&lt;TransactionStartTime&gt;\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3})" </CODE></PRE> <P>Let me know if this helps!</P> Tue, 19 Dec 2017 06:49:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348805#M103246 mayurr98 2017-12-19T06:49:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348806#M103247 <P>Thanks you mayurr98 </P> Tue, 19 Dec 2017 06:53:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-time-format-using-rex-quot-TransactionStartTime/m-p/348806#M103247 karthi2809 2017-12-19T06:53:45Z