How to configure our expected timestamp format in props.conf?

[splunker9999]

Hi,

We need to format our time stamps using props.conf, since our events do not have date/month/year to our logs, it has only %H:%M:%S. we need to append %Y/%M/%D to every event.

This is for our logs format looks like.

14:55:55,229 INFO [stdout] (ServerService THread Pool--64)ss_debug(1:)Sending secure hello message
14:55:55,232 INFO [stdout] (ServerService THread Pool--64)ss_debug(1:) server created new session

Can you please provide props configuration for this?

Thanks

[dmaislin_splunk]

What happens if you just set:

TIME_PREFIX = ^
TIME_FORMAT = %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 12

Won't it just use the current year anyway?