https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139277#M38272 <P>Try:</P> <PRE><CODE>TIME_FORMAT = %m/%d %H:%M </CODE></PRE> <P>You were using 12hr hour setting, but your log data is in 24hr notation.</P> Tue, 12 Nov 2013 20:26:25 GMT jtrucks 2013-11-12T20:26:25Z https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139275#M38270 <P>i have a log that looks something like this:</P> <PRE><CODE>terminate_type=VOICE timestamp=11/05 14:43 trunk=A044003 </CODE></PRE> <P>the format is "month/date hour/minute". under the data preview advanced pane to parse the file, i use</P> <PRE><CODE># your settings NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT=%m/%d TIME_PREFIX=timestamp\= TZ=America/Los_Angeles </CODE></PRE> <P>and it picks up the month and date fine (11/5/13). however, when i edit the format to try and pick up the time with something like:</P> <PRE><CODE>TIME_FORMAT=%m/%d %h:%M </CODE></PRE> <P>it screws up and thinks that the date is now:</P> <PRE><CODE>5/14/11 2:43:00.000 PM </CODE></PRE> <P>ie the date, month and year are all screwed up.</P> <P>any suggestions welcome!</P> Tue, 12 Nov 2013 20:10:31 GMT https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139275#M38270 ytl 2013-11-12T20:10:31Z https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139276#M38271 <PRE><CODE>TIME_FORMAT=%m/%d %H:%M </CODE></PRE> <P>Use %H when it is a 24 hour clock, %h is for a 12 hour clock.</P> Tue, 12 Nov 2013 20:16:10 GMT https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139276#M38271 ShaneNewman 2013-11-12T20:16:10Z https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139277#M38272 <P>Try:</P> <PRE><CODE>TIME_FORMAT = %m/%d %H:%M </CODE></PRE> <P>You were using 12hr hour setting, but your log data is in 24hr notation.</P> Tue, 12 Nov 2013 20:26:25 GMT https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139277#M38272 jtrucks 2013-11-12T20:26:25Z https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139278#M38273 <P>duh! thanks! that worked a treat.</P> Tue, 12 Nov 2013 21:00:19 GMT https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139278#M38273 ytl 2013-11-12T21:00:19Z https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139279#M38274 <P>Awesome, glad I could help!</P> Tue, 12 Nov 2013 21:25:26 GMT https://community.splunk.com/t5/Splunk-Search/trying-to-parse-out-a-timestamp/m-p/139279#M38274 ShaneNewman 2013-11-12T21:25:26Z