How to configure props.conf to recognize the exact timestamp format hh:mm.ss,sss in our data?

[msantich]

events from a particular source have timestamps formatted as follows: hh:mm.ss,ssss - example
02:07.21,0241

this is a strange format to be sure, and splunk does a pretty good job at "guessing" and yeilds
02:07:00.000

but our security guys aren't satisfied with this and they'd like splunks timestamp to match the event timestamp

in looking at strptime() documentation (by the way we're at splunk version 4.2.5), I see examples that suggest that using strptime() will limit me to precision year/month/day. I'm not seeing how to specifiy hour, minute, second, decimal second.

any ideas to help.

thanks so much
MichaelS

[martin_mueller · Accepted solution]

In props.conf you should set this under that sourcetype:

TIME_FORMAT = %H:%M.%S,%4N

That's assuming the 0241 part is 100-microsecond precision (1/10000th second).

[msantich]

Thank you sir.