Knowledge Management

TIME_FORMET in props.conf

chvenu17
Path Finder

My csv source data file contains below timestamp . how can we convert the timestamp into TIME_FORMET representation in props.conf file

18-AUG-21 11.40.00.027 PM"

Labels (1)
0 Karma

chvenu17
Path Finder

Thanks for the reply 

 

I have tried this, for some some reason splunk ignoring %p

props.file
TIME_FORMAT=%d-%b-%y %H.%M.%S.%3N %p
MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_PREFIX=^"

Sample data
DATE
"18-AUG-21 11.41.10.027 PM"

o/p from splunk
_time SAMPLE_TIME
2021-08-18 11:41:10.027 18-AUG-21 11.41.10.027 PM
2021-08-18 11:41:10.027 18-AUG-21 11.41.10.027 PM

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
please try to increase MAX_TIMESTAMP_LOOKAHEAD so it cover the whole timestamp from the beginning of line. Try e.g. 30 as if I calculate it right it must be 26 at least to cover it.
r. Ismo
0 Karma

manjunathmeti
Champion
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...