Splunk Search
Highlighted

How do you create a timestamp field?

New Member

I'm inputing a txt file into Splunk, and I need assistance with timestamp format and prefix.

Example event:

05:12:27.828-03/26/2019 - FR PMS

Thanks

0 Karma
Highlighted

Re: How do you create a timestamp field?

SplunkTrust
SplunkTrust

the format is this: %H:%M:%S.%3N-%m/%d/%Y not sure what FR PMS stands for

0 Karma
Highlighted

Re: How do you create a timestamp field?

Esteemed Legend

In props.conf on your indexers:

[<YourSourcetypeHere>]
TIME_FORMAT = %H:%M:%S.%3N-%m/%d/%Y
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = <RegExToSkipToBeginningOfTimestamp>
0 Karma