Hi everyone,
Given an event like the following, is there a way to get this to successfully parse as _time at index time? I've tried including the pipe in my STRPTIME format but it does not work.
xxxx|yyyy|xxxx|yyyy|xxxx|yyyy|123000|111218|xxxx|yyyy
I would think that the following would work, but it has not:
TIME_FORMAT = %H%M%S|%m%d%y
Make sure you have sensible values for TIME_PREFIX
and MAX_TIMESTAMP_LOOKAHEAD
.
^^what he says. Especially if some of those xxx, yyyy may also contain 6 digit numbers...