I have a date like May 10 2020 11:20 PM in csv file
Defined in props.conf
TIME_FORMAT - %b %d %Y %I:%M %p
but getting "Failed to parse timestamp"
what I am missing ?
| eval _raw="May 10 2020 11:20 PM"
| eval _time=strptime(_raw,"%b %d %Y %I:%M %p")
TIME_FORMAT is good.
maybe, timestamp recognition is bad.
Please share ALL of the props.conf settings for the sourcetype. Please also share a sample of the CSV file.