How to edit my TIME_FORMAT configuration to get the complete timestamp from my data?

[a212830]

Hi,

I'm certifying a new feed and having a tough time getting the entire timestamp to get recognized in the data preview tool.

Sample line is:

2015-02-05T00:00:03.008483-05:00 test_hos_vip_new snmpd[16645]: Received SNMP packet(s) from UDP: [127.0.0.1]:47377

My props:

ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 40
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N-%Z
TIME_PREFIX =^
TZ=US/Eastern

When I test this, it grabs everything up to the "-05", but not the entire "-05:00". Does it even matter?

[thomrs]

Try using %z to match the timezone better. %Z is for the timezone name.