https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317075#M162652 <P>It would also be good to specify <CODE>TIME_PREFIX</CODE>and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE> so splunk knows where the timestamp is located </P> <PRE><CODE>[sourcetype_name] TIME_PREFIX = ^ TIME_FORMAT = %d-%m-%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 </CODE></PRE> Thu, 01 Mar 2018 19:38:20 GMT skoelpin 2018-03-01T19:38:20Z https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317073#M162650 <P>Hello splunkers,</P> <P>I have logs in my file <BR /> 01-03-2018 15:54:58 WARNING [PID:88888][TradeId:11551427] /apps/abcrc/src/check/src/mx_rtpr.cpp:1146 - Sanity Check Exception void sanity_check(void*, rtPRICING_API_LIBRARY*)@/apps/abcrc/Flex/src/mx_rtpr.cpp:1034:End date not equal to option expiry date</P> <P>that log is of 1st march 2018 but splunk has taken it as a log of 3 January 2018 , please suggest how to manipulate _time field so that my new data or existing data will come in proper time format .</P> Tue, 29 Sep 2020 18:13:52 GMT https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317073#M162650 kannu 2020-09-29T18:13:52Z https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317074#M162651 <P>Include <CODE>TIME_FORMAT</CODE> in props.conf</P> <PRE><CODE>[sourcetype_name] TIME_FORMAT = %d-%m-%Y %H:%M:%S </CODE></PRE> Thu, 01 Mar 2018 17:07:00 GMT https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317074#M162651 493669 2018-03-01T17:07:00Z https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317075#M162652 <P>It would also be good to specify <CODE>TIME_PREFIX</CODE>and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE> so splunk knows where the timestamp is located </P> <PRE><CODE>[sourcetype_name] TIME_PREFIX = ^ TIME_FORMAT = %d-%m-%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 </CODE></PRE> Thu, 01 Mar 2018 19:38:20 GMT https://community.splunk.com/t5/Splunk-Search/time-improper-format/m-p/317075#M162652 skoelpin 2018-03-01T19:38:20Z