Splunk Search

How do you create a timestamp field?

clarkedayne
New Member

I'm inputing a txt file into Splunk, and I need assistance with timestamp format and prefix.

Example event:

05:12:27.828-03/26/2019 - FR PMS

Thanks

0 Karma

woodcock
Esteemed Legend

In props.conf on your indexers:

[<YourSourcetypeHere>]
TIME_FORMAT = %H:%M:%S.%3N-%m/%d/%Y
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = <RegExToSkipToBeginningOfTimestamp>
0 Karma

adonio
Ultra Champion

the format is this: %H:%M:%S.%3N-%m/%d/%Y not sure what FR PMS stands for

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...