TIME_FORMET in props.conf

[chvenu17]

My csv source data file contains below timestamp . how can we convert the timestamp into TIME_FORMET representation in props.conf file

18-AUG-21 11.40.00.027 PM"

[chvenu17]

Thanks for the reply 

I have tried this, for some some reason splunk ignoring %p

props.file
TIME_FORMAT=%d-%b-%y %H.%M.%S.%3N %p
MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_PREFIX=^"

Sample data
DATE
"18-AUG-21 11.41.10.027 PM"

o/p from splunk
_time SAMPLE_TIME
2021-08-18 11:41:10.027 18-AUG-21 11.41.10.027 PM
2021-08-18 11:41:10.027 18-AUG-21 11.41.10.027 PM

[isoutamo]

Hi
please try to increase MAX_TIMESTAMP_LOOKAHEAD so it cover the whole timestamp from the beginning of line. Try e.g. 30 as if I calculate it right it must be 26 at least to cover it.
r. Ismo

[manjunathmeti]

TIME_FORMAT=%d-%b-%y %H.%M.%S.%3N %p

For more info check: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Commontimeformatvariables