https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566021#M197229 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@LogUx</a>,</P><P>you should use:</P><LI-CODE lang="markup">TIME_PREFIX = \[ TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z</LI-CODE><P>For more infos see at&nbsp;<A href="https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables" target="_blank">https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables</A></P><P>Ciao.</P><P>Giuseppe</P> Mon, 06 Sep 2021 14:04:05 GMT gcusello 2021-09-06T14:04:05Z https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566017#M197228 <P>&nbsp;</P><P>Hello Splunkers !!</P><P>&nbsp;</P><P>What timeformat should i use for the below time in props?</P><P>&nbsp;</P><P><SPAN>[</SPAN><SPAN class="h">2021-09-06T09:10:01.459-04:00</SPAN><SPAN>]</SPAN></P> Mon, 06 Sep 2021 14:00:56 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566017#M197228 LogUx 2021-09-06T14:00:56Z https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566021#M197229 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@LogUx</a>,</P><P>you should use:</P><LI-CODE lang="markup">TIME_PREFIX = \[ TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z</LI-CODE><P>For more infos see at&nbsp;<A href="https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables" target="_blank">https://docs.splunk.com/Documentation/SCS/current/Search/Timevariables</A></P><P>Ciao.</P><P>Giuseppe</P> Mon, 06 Sep 2021 14:04:05 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566021#M197229 gcusello 2021-09-06T14:04:05Z https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566023#M197230 <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a> Its working thanks for your help Mon, 06 Sep 2021 14:10:07 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566023#M197230 LogUx 2021-09-06T14:10:07Z https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566026#M197232 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@LogUx</a>,</P><P>you're welcome!</P><P>Good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 06 Sep 2021 14:11:32 GMT https://community.splunk.com/t5/Splunk-Search/Timeformat/m-p/566026#M197232 gcusello 2021-09-06T14:11:32Z