I'm inputing a txt file into Splunk, and I need assistance with timestamp format and prefix.
Example event:
05:12:27.828-03/26/2019 - FR PMS
Thanks
In props.conf on your indexers:
[<YourSourcetypeHere>]
TIME_FORMAT = %H:%M:%S.%3N-%m/%d/%Y
MAX_TIMESTAMP_LOOKAHEAD = 23
TIME_PREFIX = <RegExToSkipToBeginningOfTimestamp>
the format is this: %H:%M:%S.%3N-%m/%d/%Y
not sure what FR PMS
stands for