The date time field I want to use for the event time is 2014-12-12 12:27:22 however SPLUNK seems to be using a combination of different fields to build the event date and time. For the above record it is deducing an event date and time of 2014-12-16 12:27:22. It seems to be deriving the date from field 5 and the time from field 7. Ultimately I would like the date and time to be derived only from field 7 i.e. 2014-12-12 12:27:22
I have tried various permutations of the following in my props.conf but still remain unsuccessful.