https://community.splunk.com/t5/Splunk-Search/time-format-help/m-p/533829#M150858 <P>Hello All,</P><P>i have source with events</P><P>****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:01:30</STRONG><BR />Partition not defined for this node:<BR />****4062182208*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:01</STRONG><BR />Partition not defined for this node:<BR />****4062182208*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:01</STRONG><BR />Partition not defined for this node:<BR />****4059036480*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4059036480*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4029676352*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*13:58:54</STRONG><BR />Partition not defined for this node:</P><P>&nbsp;</P><P>can someone help me in writing TIME_PREFIX and LINE_BREAKER?&nbsp;</P><P>&nbsp;</P> Tue, 22 Dec 2020 14:10:12 GMT AzmathShaik 2020-12-22T14:10:12Z https://community.splunk.com/t5/Splunk-Search/time-format-help/m-p/533829#M150858 <P>Hello All,</P><P>i have source with events</P><P>****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:01:30</STRONG><BR />Partition not defined for this node:<BR />****4062182208*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:01</STRONG><BR />Partition not defined for this node:<BR />****4062182208*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:01</STRONG><BR />Partition not defined for this node:<BR />****4059036480*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4059036480*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4007656256*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*14:00:00</STRONG><BR />Partition not defined for this node:<BR />****4029676352*vwxmsghdlr.cpp*03523*08000*<STRONG>2020DEC22*13:58:54</STRONG><BR />Partition not defined for this node:</P><P>&nbsp;</P><P>can someone help me in writing TIME_PREFIX and LINE_BREAKER?&nbsp;</P><P>&nbsp;</P> Tue, 22 Dec 2020 14:10:12 GMT https://community.splunk.com/t5/Splunk-Search/time-format-help/m-p/533829#M150858 AzmathShaik 2020-12-22T14:10:12Z https://community.splunk.com/t5/Splunk-Search/time-format-help/m-p/533843#M150867 <P>Try these settings.</P><LI-CODE lang="markup">[mysourcetype] LINE_BREAKER = ([\r\n])\*{4} SHOULD_LINEMERGE = false TIME_PREFIX = \*\d{5}\*\d{5}\* TIME_FORMAT = %Y%b%d*%H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 18</LI-CODE> Tue, 22 Dec 2020 14:31:38 GMT https://community.splunk.com/t5/Splunk-Search/time-format-help/m-p/533843#M150867 richgalloway 2020-12-22T14:31:38Z