I'm trying to get a csv file correctly indexed. I can't however seem to get the timestamp props.conf to work correctly.
This is a line of sample data.
A5,2012:04:30:03:48:24,AAAA,1,1,10000,0000,2012:04:30:03:48:24,0711111111,249,1800111111,07111110,,AAAA,0
This is the resulting time stamp.
Incorrect format : 11/12/2010 04:30:03.400
Correct format : 30/04/2012 03:48:24
And these are my config's.
Inputs.conf
[monitor://C:\sampledata.20120430035907.Z]
disabled = false
followTail = 0
host = LOG_HOST
index = MY_LOG
sourcetype = LOG
props.conf
[LOG]
BREAK_ONLY_BEFORE = ^A5,*
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
TIME_FORMAT = %Y:%m:%d:%H:%M:%S
TIME_PREFIX = A5,
pulldown_type = 1
TRANSFORMS-log = log_extractions
[log-extractions]
DELIMS = ","
FIELDS = "field1","field2" etc etc etc
I used the timeprefix to try and get it to detect the first time entry.
The field extraction works fine just not the initial time stamp detection.
