https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27563#M5368 <P>Hello!</P> <P>It will ignore all settings based on the text(raw) event. Also, it follows the same rule as if you put "NONE".</P> Thu, 06 Mar 2014 18:31:07 GMT gacerioni 2014-03-06T18:31:07Z https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27561#M5366 <P>I have a log file that has a date at the top, but otherwise is essentially unpredictable stdout. It could be written to for minutes or days.</P> <P>This seems appropriate and acceptable:<BR /> SHOULD_LINEMERGE = False<BR /> DATETIME_CONFIG = CURRENT</P> <P>What I'm wondering is if I have a TIME_PREFIX and TIME_FORMAT, will it try those first? The first line is predictable, so I could at least capture that single real date.</P> Mon, 28 Sep 2020 09:40:23 GMT https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27561#M5366 vbumgarner 2020-09-28T09:40:23Z https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27562#M5367 <P>V,</P> <P>I believe setting <CODE>DATETIME_CONFIG=CURRENT</CODE> or <CODE>DATETIME_CONFIG=NONE</CODE> will ignore <CODE>TIME_PREFIX</CODE>/<CODE>TIME_FORMAT</CODE> (you can only use one or the other; not one then the other).</P> Wed, 15 Jun 2011 15:44:35 GMT https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27562#M5367 hazekamp 2011-06-15T15:44:35Z https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27563#M5368 <P>Hello!</P> <P>It will ignore all settings based on the text(raw) event. Also, it follows the same rule as if you put "NONE".</P> Thu, 06 Mar 2014 18:31:07 GMT https://community.splunk.com/t5/Splunk-Search/TIME-FORMAT-vs-DATETIME-CONFIG-CURRENT/m-p/27563#M5368 gacerioni 2014-03-06T18:31:07Z