https://community.splunk.com/t5/Splunk-Search/Extracting-timestamp-out-of-records/m-p/57446#M14027 <P>I have system records which are in following format</P> <P>RECORD_DATE=20130124145912|NAME=XYZ|PHONE=XXXXX|</P> <P>Normally there is delay of 2-3 hours before these records reach Splunk server.</P> <P>Splunk is displaying reports based on the time it receives records, can I configure Splunk to build all reports based on RECORD_DATE?</P> <P>RECORD_DATE is in YYYYMMMDDHHMMSS format.</P> <P>I have use strftime function for some of my reports, but this doesn't work for timeline. </P> <P>strftime(strptime(RECORD_DATE ,"%Y%m%d%H%M"),"%Y-%m-%d %H:%M")</P> <P>I want Splunk to use RECORD_DATE for timeline</P> Thu, 06 Jun 2013 21:20:09 GMT rohitkashikar 2013-06-06T21:20:09Z https://community.splunk.com/t5/Splunk-Search/Extracting-timestamp-out-of-records/m-p/57446#M14027 <P>I have system records which are in following format</P> <P>RECORD_DATE=20130124145912|NAME=XYZ|PHONE=XXXXX|</P> <P>Normally there is delay of 2-3 hours before these records reach Splunk server.</P> <P>Splunk is displaying reports based on the time it receives records, can I configure Splunk to build all reports based on RECORD_DATE?</P> <P>RECORD_DATE is in YYYYMMMDDHHMMSS format.</P> <P>I have use strftime function for some of my reports, but this doesn't work for timeline. </P> <P>strftime(strptime(RECORD_DATE ,"%Y%m%d%H%M"),"%Y-%m-%d %H:%M")</P> <P>I want Splunk to use RECORD_DATE for timeline</P> Thu, 06 Jun 2013 21:20:09 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-timestamp-out-of-records/m-p/57446#M14027 rohitkashikar 2013-06-06T21:20:09Z https://community.splunk.com/t5/Splunk-Search/Extracting-timestamp-out-of-records/m-p/57447#M14028 <P>Your statement is not entirely true. The Real-time search is the only portion that streams live/continous view of events, which I dont think you are using. When you run a search that does not include real-time you are just running report. Splunk will extracted _time from your log/event at time of index based on your props.conf. If you want Splunk to use the RECORD_DATE for your events timestamp you need to configure you props.conf for that source/sourcetype on your indexers.</P> <P><CODE></CODE><PRE><CODE><BR /> #props.conf stanza example (only an example)<BR /> [RECORD]<BR /> NO_BINARY_CHECK=1<BR /> SHOULD_LINEMERGE=false<BR /> MAX_TIMESTAMP_LOOKAHEAD=38<BR /> TIME_PREFIX=RECORD_DATE=<BR /> TIME_FORMAT="%Y%m%d%H%M"<BR /> </CODE></PRE></P> <P>Additional Reading: </P> <UL> <LI><A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsearch">Aboutsearch</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Indextimeversussearchtime">Indextimeversussearchtime</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Handleeventtimestamps">Handleeventtimestamps</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Propsconf">Propsconf</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches">Aboutrealtimesearches</A></LI> </UL> <P>Hope this help you or gets you started. Dont forget to vote and accept answers that help.</P> Thu, 06 Jun 2013 22:19:58 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-timestamp-out-of-records/m-p/57447#M14028 bmacias84 2013-06-06T22:19:58Z