Getting Data In

Splunk won't correctly recognize timestamp

pero1234
Path Finder

Why splunk won't correctly recognize this timestamp?

120129092233

my props.conf

TIME_FORMAT=%Y%m%d%H%M%S
TIME_PREFIX=^

example of source log:

120129092231;field1 field2  field3
120129092232;field1 field2  field3
120129092233;field1 field2  field3
Tags (2)
1 Solution

imrago
Contributor

try:

TIME_FORMAT=%y%m%d%H%M%S
TIME_PREFIX=^

View solution in original post

imrago
Contributor

try:

TIME_FORMAT=%y%m%d%H%M%S
TIME_PREFIX=^

pero1234
Path Finder

Works! Yes, y% is for year without century like in my log.
Splunk rocks!!

0 Karma

hedgehog
Explorer

Your time_Prefix stanza looks correct but I dont think you need the prefix. Not sure if the docs will shed some light but you can fine them here: http://docs.splunk.com/Documentation/Splunk/latest/Data/
ConfigureTimestampRecognition

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...