Splunk Search

How do you create a timestamp field?

clarkedayne
New Member

I'm inputing a txt file into Splunk, and I need assistance with timestamp format and prefix.

Example event:

05:12:27.828-03/26/2019 - FR PMS

Thanks

0 Karma

woodcock
Esteemed Legend

In props.conf on your indexers:

[<YourSourcetypeHere>]
TIME_FORMAT = %H:%M:%S.%3N-%m/%d/%Y
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = <RegExToSkipToBeginningOfTimestamp>
0 Karma

adonio
Ultra Champion

the format is this: %H:%M:%S.%3N-%m/%d/%Y not sure what FR PMS stands for

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...