Getting Data In

How can I set a TIME_PREFIX without prefix

nicolasydder
Explorer

Hi folks,

I wanted to add the first field as timestamp :

150503;ULSTTTK073TTTXXX;XXXXXXXX;15/04/27;13:11:35  

but my stanza in my props.conf doesn't match this field...

[my_stanza]
TIME_FORMAT=%y%m%d
TIMESTAMP_FIELDS = DDATFCT
TIME_PREFIX = 
MAX_TIMESTAMP_LOOKAHEAD=50
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
KV_MODE=none
disabled=false
pulldown_type=true

A transforms.conf is used to set FIELD_NAME with DDATFCT as first element.

Do I set a null TIME_PREFIX to force to recognize my timestamp fields ?
Be aware that time fields doesn't have any prefixe...

BR

Nicolas Y.

0 Karma
1 Solution

woodcock
Esteemed Legend

woodcock
Esteemed Legend

TIME_PREFIX = ^

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...