Getting Data In
Highlighted

How to write props.conf to extract an epoch time as timestamp from events?

Contributor

I have a epoch time in my events: timestamp=1478787869121. How to write props.conf to extract this timestamp?

0 Karma
Highlighted

Re: How to write props.conf to extract an epoch time as timestamp from events?

Builder

Try this:

[your sourcetype]
TIMEPREFIX = timestamp=
TIME
FORMAT = %s%3N

0 Karma