PROPS Config...Different Time Formats within Same Source File

[SplunkDash]

Hello,

I am a source file which has  events with 2 different file formats. How would I write  TIME_FOMAT for my PROPS Configuration file. any help will be highly appreciated. Thank you..

2021/05/30 16:28:12    JAVA_OPTION_USESERVERCIPHERSUITESORDER:-DuseServerCipherSuitesOrder=true

2021/05/30 16:28:12    JAVA_OPTION_XMX:-Xmx196m

2021-05-30 16:28:27.872  INFO 28709 --- [           main] .c.r.b.i.e.ConsulBootstrapPropertyLoader

2021-05-30 16:28:43.677  INFO 28709 --- [           main] com.sas.studio.ApplicationPetrichor

[richgalloway]

One cannot have more than one TIME_FORMAT setting for a sourcetype.  Sometimes, different time formats means different sourcetypes, but that's not always the case.

If you truly have multiple timestamp formats in the same source type then, first, slap the developer.  Ask the admin if timestamp formats are adjustable.  Finally, give up on TIME_FORMAT and let the datetime.xml file parse the times for you.  It's less than ideal, but probably the best you can do.