Time Format Help

[rlaan]

I am looking for help figuring out how to represent the following timestamp as a prefix for parsing time/start of events. this is contained in some logs i was provided today and am having difficulty figuring out how to get pas the "o'clock" contained within the log files. these are new logs that were indexed under an existing sourcetype that already had a working/existing timestamp format.

Old format: (majority of logs)
[2021-02-23T14:37:26.659-07:00]

New/abnormal format: (some weird new stuff) 
<23-Feb-2021 2:21:41 o'clock PM MST>

I am trying to figure out how best to capture the new format logs from the existing sourcetype and redirect them into the proper timestamp configuration or a new sourcetype of their own.

[scelikok · Accepted solution]

Hi @rlaan,

You can use below time format;

TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z