Hi,
I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.
Sample line is:
2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377
My props:
ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 40
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z
TIME_PREFIX =^
TZ=US/Eastern
When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter?
Try using %z to match the timezone better. %Z is for the timezone name.