If I have two time fields in an event, how do I configure Splunk to use the 2nd one as the timestamp?

[jpelletier_splu]

My log file looks like below. I need Splunk to ID the time_of_stop time -- instead of the the time included with the date of stop prefixed with T

Should I use the field extractor to extract the T00:00:00? The time essentially is in two places and I want Splunk to grab the second one...

/_4mse-ku6q/1747516"> date of stop 2015-07-08T00:00:00 date of stop  time of stop18:20:00time of stopMCP1st district, Rockville

[somesoni2 · Accepted solution]

Try something like this (props.conf on Indexer/HF)

[YourSourceType]
TIME_FORMAT=%Y-%m-%dT00:00:00 date of stop time of stop%H:%M:%S
TIME_PREFIX=date of stop\s+
MAX_TIMESTAMP_LOOKAHEAD=53
...Other settings....

[jpelletier_splu]

This worked great with some minor tweaks! THANKS

[ppablo]

Hi @jpelletier

Glad you found a solution through @somesoni2 🙂 Don't forget to resolve yours posts by clicking "Accept" directly below the answer that best addressed your question. Also, be sure to upvote other users' answers/comments that helped you out to award them karma points. It's also good practice to share the final configuration with your minor tweaks so others are aware of the exact solution that worked for you. Thanks!