Getting Data In

How to edit my time_prefix and time format in props.conf?

saifuddin9122
Path Finder

Oct 20, 2016 11:49:56 PM UTC here is my time format and every event starts with with time.

in my props.conf i had

TIME_PREFIX=TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 28
TIME_FORMAT=%m/%d/%Y %H:%M:%S

is this correct?? if not can anyone please let me know where i am doing mistake

Thanks

0 Karma
1 Solution

DMohn
Motivator

The correct settings are:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 28
TIME_FORMAT = %b %d, %Y %H:%M:%S %p %Z

View solution in original post

DMohn
Motivator

The correct settings are:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 28
TIME_FORMAT = %b %d, %Y %H:%M:%S %p %Z

Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...