Sample log line date part:
Nov 16 22:48:36
props.conf on indexer
TIME_PREFIX = ^
TIME_FORMAT = %b %e %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 15
I use "%e" because the day field is populated without leading zero's.
What am I doing wrong?
1) Splunk is showing me the 'offset' time based upon my TZ setting.
2) For some reason, for this source type ONLY, splunk is showing the AM/PM declaration. Not sure why.
1) Splunk is showing me the 'offset' time based upon my TZ setting.
2) For some reason, for this source type ONLY, splunk is showing the AM/PM declaration. Not sure why.