Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.
Here are the entries in my props.conf file:
I used the regex for the timestamp based on this post here:
Any advice would be appreciated.
Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!
View solution in original post