I spent the whole day and finally found out the solution: %Y/%m/%d %P %I:%M:%S use above to define timestamp, ALSO you have to clarify the name of the time(order_date) for example as the csv file:    order_date   product 2020/12/1 上午 11:01:46   cups 2020/12/16 下午 04:01:46  unberllas and as the splunk ingests the file, you will get _time 2020/12/1  11:01:46 2020/12/16  16:01:46 ... View more

<datetime> <define name="ccm_1_date" extract="year,month,day"> <text><![CDATA[\s(\d{4})/(\d{2})/(\d{1-2})]]></text> </define> <define name="_ampm" extract="ampm"> <text><![CDATA[([ap]m(?:[^A-Za-z0-9]|$)|[\x{4E0A}\x{4E0B}]\x{5348})?]]></text> </define> <define name="ccm_1_time" extract="hour,minute,second"> <text><![CDATA[\w{2}s(\d{2}):(\d{2}):(\d{2})]]></text> </define> <timePatterns> <use name="ccm_1_time"/> </timePatterns> <datePatterns> <use name="ccm_1_date"/> </datePatterns> </datetime> hi thanks you for the reply I found out that if the time is "2020/12/1 12:01:46 上午" the system can recognize Chinese and extract the time correctly to "20/12/01 0:01:46.000" However, the system cannot extract  "2020/12/1 上午 12:01:46 " correctly. I try to write the datetime2.xml like this:   But it fails....... ... View more