Timestamp detection fails

FRoth — Mon, 03 Jun 2013 15:58:47 GMT

I try to parse out the timestamp of this line:

Jun  3 17:39:09 svlog.myserver.net svdcdev 04/29/2013 09:14:37 AM   LogName=Security    SourceName=Microsoft Windows security auditing.

I tried the following format during the input creation > Data Preview > Timestamp:

%m/%d/%Y %I:%M:%S %p

What is wrong with this format definition?

Re: Timestamp detection fails

FRoth — Mon, 03 Jun 2013 16:06:18 GMT

I hat to define a prefix to tell him, that he should not try to parse the first occuring but the second occuring timestamp:

TIME_PREFIX=[^\s]+[\s]+[^\s]+ [^\s]+ [^\s]+ [^\s]+