Getting Data In

How to write props.conf to extract an epoch time as timestamp from events?

ankithreddy777
Contributor

I have a epoch time in my events: timestamp=1478787869121. How to write props.conf to extract this timestamp?

0 Karma

sk314
Builder

Try this:

[your sourcetype]
TIME_PREFIX = timestamp=
TIME_FORMAT = %s%3N

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!