Need help in writing regex

[Praz_123]

Hi 

I need the same time in events and _time  while importing the data getting the time difference what to write in time_prefix field 

[gcusello]

Hi @Praz_123 ,

could you share a sample of your logs in text format?

Ciao.

Giuseppe

[livehybrid]

Hi @Praz_123 

In props.conf, use the following settings to extract the timestamp in your sourcetype:

[yourSourcetype]
TIME_PREFIX = ^"
TIME_FORMAT = %m/%d/%y %H:%M:%SZ

Explanation:

• TIME_PREFIX anchors the timestamp extraction immediately after the opening quote at the start of the line.
• TIME_FORMAT matches the date/time format: month/day/two-digit year, space, hour:minute:second, and a trailing "Z" for UTC.

For more info check out https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

If you are able to share a raw event (redacted if required) we can validate it but the above should hopefully work.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing