Getting Data In

Timestamp format

merp96
Path Finder

What could be the TIME_FORMAT=? for the below timestamp in event
2015-03-18 14:18:17 0.175

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

2015-03-18 14:18:17 0.175 --- may i know what is this 0. before 175(milli seconds)

please try this in props.conf:

 TIME_FORMAT = %Y-%d-%m %H:%M:%S

Best Regards,
Sekar

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

2015-03-18 14:18:17 0.175 --- may i know what is this 0. before 175(milli seconds)

please try this in props.conf:

 TIME_FORMAT = %Y-%d-%m %H:%M:%S

Best Regards,
Sekar

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

merp96
Path Finder

I guess 0.175 is not part of timestamp. What do you think about it.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

ok then, we can discard it. use only till %S
TIME_FORMAT = %Y-%d-%m %H:%M:%S

if "0." was not there, then, we can think of it as 175 milli seconds (%N).
may be its part of the remaining line.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

merp96
Path Finder

yes I believe so, will check with the team logging the source
Thanks

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...