Getting Data In
Highlighted

How to configure props.conf for a Unix timestamp in a JSON log file?

Builder

All,

I have a json log file we're bringing in.

Its time is logged as:

"start":"1461191869.576”

Any idea on where I would start with props.conf for timestamping?

0 Karma
Highlighted

Re: How to configure props.conf for a Unix timestamp in a JSON log file?

Influencer

Try this:

[your_sourcetype]
TIME_PREFIX = "start":"
TIME_FORMAT = %s.%3N

View solution in original post

0 Karma