Default _time extraction

[camah4]

I have an example log file with the following format:

Nov 05 10:33:37 servername applicationserver: instance,ipaddress,[05/Nov/2011:10:33:33 +0000]

I would like the second time column which contains [05/Nov/2011:10:33:33 +0000] to be column which is used for _time at index time, currently by default it uses Nov 05 10:33:37.

Any suggestion on how to tech splunk to use the alternative timestamp for _time would be appreciated.

Thanks

[araitz]

Please create only one post per question:

http://splunk-base.splunk.com/answers/34422/default-_time

[Takajian]

Please see following manual. Hope this help.

http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Configuretimestamprecognition