Hello,
I have syslog events that come with the _time either in seconds(epoch 1620685037) OR time in microseconds from epoch(16206722176.001440).
Can a props.conf handle either of these formats and set the time stamp appropriately? I realize there is going to be some performance impact on timestamps going all the way to micro, but the searches are not too bad and the data set if not tremendous.
How should the props.conf look like?
g
