Hey everyone. I am trying to add a time-format to my props.conf file. The source is a csv file containing multiple timestamps for each event. I'm only interested in the first one.
The timestamp looks like this in the event:
15:09:55.128 UTC AUG 31 2011
So in my props.conf I was planning to add something like this:
Is there a more elegant way to handle the time zone being embedded in the middle? I can't find any reference in strptime() to dealing with time zones. Any help would be appreciated. I've tried letting splunk recognize the timestamp but it seems to be screwing up a bit.