Getting Data In

Timestamp format

merp96
Path Finder

What could be the TIME_FORMAT=? for the below timestamp in event
2015-03-18 14:18:17 0.175

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

2015-03-18 14:18:17 0.175 --- may i know what is this 0. before 175(milli seconds)

please try this in props.conf:

 TIME_FORMAT = %Y-%d-%m %H:%M:%S

Best Regards,
Sekar

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

2015-03-18 14:18:17 0.175 --- may i know what is this 0. before 175(milli seconds)

please try this in props.conf:

 TIME_FORMAT = %Y-%d-%m %H:%M:%S

Best Regards,
Sekar

merp96
Path Finder

I guess 0.175 is not part of timestamp. What do you think about it.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

ok then, we can discard it. use only till %S
TIME_FORMAT = %Y-%d-%m %H:%M:%S

if "0." was not there, then, we can think of it as 175 milli seconds (%N).
may be its part of the remaining line.

0 Karma

merp96
Path Finder

yes I believe so, will check with the team logging the source
Thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...