Splunk - Assigning custom time

[gunnist]

I want my time to be the "Date" property in the following json:

{ "Level": "ERROR", "Date": "2021-08-20 17:21:53.6355", "Logger":.... }

I created a props.conf here: ...\Splunk\etc\system\local with:

TIME_PREFIX = "Date":\s"
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

I then restarted splunk...but it's not working. Any idea what I'm missing?

[richgalloway]

The current settings say Splunk should find a 4-digit year immediately following '"Date":', but that's not the case. Try TIME_PREFIX = "Date":\s". There's no need to escape the quotation marks.