Do I need to escape a pipe character for TIME_FORMAT in props.conf?

[bwooden]

Do I need to escape the | (pipe character) for a TIME_FORMAT in props.conf?

Example Timestamp:

2014-02-07 || 5:30:02

[bwooden · Accepted solution]

No you do not. Your TIME_FORMAT would look like this:

TIME_FORMAT=%Y-%m-%d || %H:%M:%S

Per:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

NB: You would escape a pipe in a TIME_PREFIX