Time format is not working as per props.conf file

[ajitshukla61116]

I want to ingest data at current time ,for that we are using props.conf file ,the configuration for which is

props.conf
DATETIME_CONFIG =CURRENT
TIME_FORMAT =%Y-%m-%d %H:%M:%S

I am getting current time properly but TIME FORMAT is not working.

I don't know what is the issue ,please help me to resolve this issue.

[woodcock]

The TIME_FORMAT setting is for when you parse event characters to pull out timestamps, which you are NOT doing so it is not used.

There is only 1 way to change how timestamps appear generally, that is to use a different localization which is part of your URL. Most of the time this is en-US but try en-GB for example, to see how it changes. In any case, you have FULL CONTROL of this on a search-by-search basis. Just add this to the bottom/middle of any search:

... | fieldformat _time=strftime(_time, "%Y-%m-%d %H:%M:%S")

[VatsalJagani]

Hello @ajitshukla,
Timestamp in Splunk stored in epoch format (interger) not in any string format so here TIME_FORMAT will not be used as you have added DATETIME_CONFIG to CURRENT.

[richgalloway]

TIME_FORMAT applies to parsing timestamp strings in events. You are not parsing timestamps.

If you want to change how timestamps are presented to users, try the strftime function. For example, ... | eval time=strftime(_time, "%Y-%m-%d %H:%M:%S") | table time ....