- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reed_kelly
Contributor
11-09-2017
07:05 AM
Is there a document or configuration file that spells out all of the accepted default time formats on input. In other words, what are ALL the date/time formats that are accepted if I do not specify a format string in props.conf?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
11-09-2017
07:24 AM
You really should specify TIME_FORMAT in props.conf for all your sourcetypes. It's a Splunk Best Practice.
Default time formats are in $SPLUNK_HOME/etc/datetime.xml.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
11-09-2017
07:24 AM
You really should specify TIME_FORMAT in props.conf for all your sourcetypes. It's a Splunk Best Practice.
Default time formats are in $SPLUNK_HOME/etc/datetime.xml.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
