Timestamps

[drpsycho]

Hi im importing logs from cisco switches and in the search the time that stays in the begginig of the events shows like this 27/09/2011 17:46:00.000 and never show the seconds. What can i do? Thanks

I figured it out. I just change the option "MAX_TIMESTAMP_LOOKAHEAD" from 32 to 35 for cisco_syslog in props.conf. But now i wanna supress the .000 that shows in the end of the timestamp. How?

[rgcurry]

From your first paragraph, it seems the ".000" is always there. Try hard-coding that in your TIME_FORMAT clause. That should eliminate that extra data.