topic Re: Multiple time logs in one timestamp in Splunk Search https://community.splunk.com/t5/Splunk-Search/Multiple-time-logs-in-one-timestamp/m-p/423029#M173443 <P>Hi,</P> <P>If you want to extract timestamp from your logs (which has different formats) then you can create custom datetime.xml which will extract correct timestamp, please refer <A href="https://answers.splunk.com/answers/692340/how-can-we-set-time-format-in-propsconf-where-the.html">https://answers.splunk.com/answers/692340/how-can-we-set-time-format-in-propsconf-where-the.html</A></P> Thu, 24 Jan 2019 12:22:31 GMT harsmarvania57 2019-01-24T12:22:31Z Multiple time logs in one timestamp https://community.splunk.com/t5/Splunk-Search/Multiple-time-logs-in-one-timestamp/m-p/423028#M173442 <P>Hello</P> <P>Multiple time logs in one timestamp<BR /> example</P> <P>19/01/24 10:28:51 [2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:212] ## Syslog Process.<BR /> [2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:179] #### Syslog Message received<BR /> [2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:220] ## Syslog L3IP Process</P> <P>i need field</P> <P>19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:212] ## Syslog Process.<BR /> 19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:179] #### Syslog Message received<BR /> 19/01/24 10:28:51[2019-01-24 10:28:51] DEBUG [SyslogReceiver.java:220] ## Syslog L3IP Process</P> <P>where is alter<BR /> $SPLUNK_HOME/etc/system/local/props.conf </P> <P>thank you</P> Thu, 24 Jan 2019 05:06:07 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-time-logs-in-one-timestamp/m-p/423028#M173442 jsryu0247 2019-01-24T05:06:07Z Re: Multiple time logs in one timestamp https://community.splunk.com/t5/Splunk-Search/Multiple-time-logs-in-one-timestamp/m-p/423029#M173443 <P>Hi,</P> <P>If you want to extract timestamp from your logs (which has different formats) then you can create custom datetime.xml which will extract correct timestamp, please refer <A href="https://answers.splunk.com/answers/692340/how-can-we-set-time-format-in-propsconf-where-the.html">https://answers.splunk.com/answers/692340/how-can-we-set-time-format-in-propsconf-where-the.html</A></P> Thu, 24 Jan 2019 12:22:31 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-time-logs-in-one-timestamp/m-p/423029#M173443 harsmarvania57 2019-01-24T12:22:31Z