Hi, hoping someone can help with this as its been a while since I used Splunk and I can't seem to figure this out!
I'm trying to import a csv that has a field with a time format of:
[20210102] 06:58.10
I have tried TIME_FORMAT=%Y%m%d %H:%M.%S
and I get a _time field that is correct except it doesn't show the seconds. the above is returned as 02/01/2021 06:58:00
I'm pretty sure its to do with the way the square brackets are being interpreted but can't seem to work out how to ignore them. Adding them into the TIME_FORMAT string doesn't help.
Thanks.
Include the brackets in the time format
TIME_PREFIX = \[
TIME_FORMAT = %Y%m%d] %H:%M.%S
Include the brackets in the time format
TIME_PREFIX = \[
TIME_FORMAT = %Y%m%d] %H:%M.%S
No, sorry, that doesn't work. I also tried TIME_PREFIX=^\[
How are you testing it? If you're editing a props.conf file then be sure to restart Splunk afterwards. Also, make sure to edit the correct file.
You know the settings only apply to new data, right?
Many thanks, forgot to do the restart.