Hi @sara_papa, probably you well know that 6.5.1 isn't a supported version of Splunk! Anyway, the timestamp parsing is done on the Indexers or, when present, on Heavy Forwarders, not on Universal Forwarder. So you should put the props.conf to parse your logs in a TA to install on Indexers. Anyway, try only a simple update to your props.conf, escaping "=" because it's a special char.: TIME_PREFIX = timestamp_start\= Anyway, as I said, I think that the problem is in the location of your props.conf. You have to put props on Forwarders only if you have an INDEXED_EXTRACTION. Ciao. Giuseppe ... View more