https://community.splunk.com/t5/Splunk-Search/Date-format/m-p/98264#M25317 <P>further modifications to the transforms.conf fixed the issue.</P> Mon, 22 Oct 2012 20:48:23 GMT efelder0 2012-10-22T20:48:23Z https://community.splunk.com/t5/Splunk-Search/Date-format/m-p/98263#M25316 <P>I am having an issue with outputting a Date/Time stamp. Here is the scenario:</P> <UL> <LI>Indexing a CSV file containing a field "Current_Date"</LI> <LI>In my output file, I am concatenating that "Current_Date" field with the Splunk _indextime into a field called "CreateTimeStamp"</LI> <LI>However, this is my output --&gt; Current_Date value is '1', _indextime = "15:40". Need it to look like "10/14/2012 15:40"</LI> </UL> <P>Snippet from prop.conf:<BR /> SHOULD_LINEMERGE = false</P> <H1>BREAK_ONLY_BEFORE = \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}</H1> <P>TIME_PREFIX = ^([^,]+,){9}<BR /> TIME_FORMAT = %m/%d/%Y %H:%M</P> <H1>LINE_BREAKER = ([\r\n]+)[A-Z0-9-]+,</H1> <P>REPORT-csvepo3 = csvepo3<BR /> TRANSFORMS-removeheader4 = removeheader4</P> <P>Snippet from transforms.conf:</P> <P>[removeheader4]<BR /> REGEX = ^System_Name,Last_Comm,Last_Comm_Diff<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>Any suggestions?</P> Mon, 28 Sep 2020 12:40:19 GMT https://community.splunk.com/t5/Splunk-Search/Date-format/m-p/98263#M25316 efelder0 2020-09-28T12:40:19Z https://community.splunk.com/t5/Splunk-Search/Date-format/m-p/98264#M25317 <P>further modifications to the transforms.conf fixed the issue.</P> Mon, 22 Oct 2012 20:48:23 GMT https://community.splunk.com/t5/Splunk-Search/Date-format/m-p/98264#M25317 efelder0 2012-10-22T20:48:23Z