https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135041#M36919 <P>I am trying to apply a custom TIME_FORMAT to a wildcarded source in props.conf, but Splunk doesn't seem to be applying it (i.e. Splunk still shows the wrong _time in my search against this source). </P> <P>What am I doing something wrong?</P> <P>Example source:<BR /> <CODE>albatross-b827e88ab79c.vsat.20150209.speedtest.csv</CODE><BR /> My entry in props.conf:</P> <PRE><CODE> [source::*speedtest.csv] TIME_FORMAT = %Y%m%d%H%M TIME_PREFIX = ^ </CODE></PRE> <P>Sample event:<BR /> <CODE>201502062345,albatross-b827ebe142fe.vsat,12.23,Mb,3.30,Mb</CODE></P> Tue, 10 Feb 2015 18:23:17 GMT masonmorales 2015-02-10T18:23:17Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135041#M36919 <P>I am trying to apply a custom TIME_FORMAT to a wildcarded source in props.conf, but Splunk doesn't seem to be applying it (i.e. Splunk still shows the wrong _time in my search against this source). </P> <P>What am I doing something wrong?</P> <P>Example source:<BR /> <CODE>albatross-b827e88ab79c.vsat.20150209.speedtest.csv</CODE><BR /> My entry in props.conf:</P> <PRE><CODE> [source::*speedtest.csv] TIME_FORMAT = %Y%m%d%H%M TIME_PREFIX = ^ </CODE></PRE> <P>Sample event:<BR /> <CODE>201502062345,albatross-b827ebe142fe.vsat,12.23,Mb,3.30,Mb</CODE></P> Tue, 10 Feb 2015 18:23:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135041#M36919 masonmorales 2015-02-10T18:23:17Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135042#M36920 <P>Since your timestamps are the beginning of each event, you don't need TIME_PREFIX.</P> Tue, 10 Feb 2015 18:52:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135042#M36920 richgalloway 2015-02-10T18:52:40Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135043#M36921 <P>Right, it still wouldn't recognize it without TIME_PREFIX though. I am starting to think you can't apply TIME_FORMAT to a source because I couldn't find an example in the props.conf.spec.</P> <P>I worked around the issue by re-indexing the data under a new sourcetype I created with the time_format settings.</P> Mon, 28 Sep 2020 18:53:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135043#M36921 masonmorales 2020-09-28T18:53:15Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135044#M36922 <P>I would add a MAX_TIMESTAMP_LOOKAHEAD = 20 ... (it has been helpfull to me in the past) just to make sure SPlunk does not reads to long into the file, since it is in the beginning.</P> <P>I can also recommend the "Data preview" function that exists in SPlunk now ... it will display / help you with this sorts of problems.</P> Mon, 28 Sep 2020 18:56:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135044#M36922 lmyrefelt 2020-09-28T18:56:11Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135045#M36923 <P>I believe that there is a bug with using a wildcard with a source in props.conf -- the wildcard pattern only works in some scenarios. We have seen issues with * specifically.</P> <P>Support acknowledges but has not fixed. Documentation should be updated to reflect not to use asterisk as a wildcard, use ... instead.</P> Mon, 01 Jun 2015 23:43:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-a-custom-TIME-FORMAT-specific-to-source-with-a/m-p/135045#M36923 the_wolverine 2015-06-01T23:43:01Z