Been trying to get this to work but to no avail...
I have a CSV file that goes like this:
pid hostname c1 c2 c3 status date time message
123456 serverA 0 0 0 54058938 20100301 033412 Error with Transfer
I am trying to parse the fields date and time and I have specified something like this in my props.conf
TIME_PREFIX = \w+\s\w+\s\w+\s\w+\s\w+\s\w+\s
TIME_FORMAT = %Y%m%d %H%M%S
But I couldn't get the date/time indexed correctly.
But if I change my original log source to be 20100301033412 (without the space in-between), it works fine.
Has anyone solved this before? Any response is much appreciated. Thanks.
I believe you can use
%t in the time formats to represent any white space, including a tab character. I am not sure if
\t would work specifically for a tab character, but there is a good chance it will.