timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format?

[lessthan80]

the output in splunk console:
3/3/23
2:05:41.000 AM

03/03/2023 02:05:41 p.m. 14664 5046661

Note that the splunk _time is pulling the timestamp from _raw, but not interpreting the "p.m." so splunk is posting the time of the event as 2:05 AM.  I have have tried a few different combinations for the TIME_FORMAT in the props.conf file, and nothing is helping.

here is the current TIME_FORMAT stanza

[###_###_###_#######]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %d/%m/%Y %I:%M:%S
TIME_PREFIX = ^
category = Custom
disabled = false
pulldown_type = true
EXTRACT-total_processing_time = ^[^\t\n]*\t(?P<total_processing_time>\d+\t)
EXTRACT-application_id = ^(?:[^\t\n]*\t){2}(?P<application_id>.+)

current TIME_FORMAT
TIME_FORMAT = %d/%m/%Y %I:%M:%S
I've tried this with %p and %P with no success.   Any ideas?

[lessthan80]

I started reviewing both answers and they both appear to be correct.   With this information i expect to be able the correct the eventtime problem.   Thanks to both.

[richgalloway]

It looks like the dots in "p.m." are getting in the way.  The %p format character expects either "am" or "pm" (in either case) - no dots.

You may be able to parse that timestamp with a custom datetime.xml file.  See https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuredatetimexml#:~:text=The%20Spl....

[PickleRick · Accepted solution]

Custom datetime.xml is one way you can go. You can also use INGEST-EVAL to adjust your timestamp in post-extraction processing. See the great .conf presentation

https://conf.splunk.com/files/2020/slides/PLA1154C.pdf

There are several examples of dealing with timestamps there.