TIMEֹֹ_FORMAT configuration - Splunk Community

Getting Data In

I have a date like May 10 2020 11:20 PM in csv file

Defined in props.conf
TIME_FORMAT - %b %d %Y %I:%M %p

but getting "Failed to parse timestamp"

what I am missing ?

Please share ALL of the props.conf settings for the sourcetype. Please also share a sample of the CSV file.

---
If this reply helps you, Karma would be appreciated.

| makeresults
| eval _raw="May 10 2020 11:20 PM"
| eval _time=strptime(_raw,"%b %d %Y %I:%M %p")

TIME_FORMAT is good.
maybe, timestamp recognition is bad.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers, We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...