topic TIME_PREFIX regex help in Getting Data In

TIME_PREFIX regex help

wouterr — Thu, 06 Jun 2013 20:36:05 GMT

Hi,

I seem to be incapable of figuring out what regex to provide in the TIME_PREFIX for my source type in order to recognize the second time stamp instead of the first.

Please see a sample event below

"Jun 04 2013 12:00:00:001AM","5333079266","310410257633304","8","Jun 03 2013 03:55:43:000PM"

Thanks

Re: TIME_PREFIX regex help

bmacias84 — Mon, 28 Sep 2020 14:03:18 GMT

I see you have two timestamps so you want the second timestamp used for _time? if so try



TIME_PREFIX=","

TIME_FORMAT=%b %d %Y %I:%M:%S:%3N:%r

Re: TIME_PREFIX regex help

Hajime — Fri, 07 Jun 2013 03:01:17 GMT

Hello wouterr,

I think as you said bmacias84, and may be set as follows.

TIME_PREFIX=","

TIME_PREFIX=,"