- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you create a timestamp field?
clarkedayne
New Member
04-02-2019
01:48 AM
I'm inputing a txt file into Splunk, and I need assistance with timestamp format and prefix.
Example event:
05:12:27.828-03/26/2019 - FR PMS
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
04-02-2019
05:52 PM
In props.conf on your indexers:
[<YourSourcetypeHere>]
TIME_FORMAT = %H:%M:%S.%3N-%m/%d/%Y
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = <RegExToSkipToBeginningOfTimestamp>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

adonio
Ultra Champion
04-02-2019
04:23 AM
the format is this: %H:%M:%S.%3N-%m/%d/%Y
not sure what FR PMS
stands for
