I have a log file that is tab delimited. It has a field called "date" and a field called "time" next to each other. This is the format of the fields: 2013-10-24 11:40:23 The issue I'm having is that sometimes another field such as "8.1.5"(just some random value) that does not match the TIME_FORMAT shows up in the user agent string and somehow takes control over the date and time fields, thus producing wrong date/time on those records.(in this case August 1st 2005) I have tried TIME_PREFIX=[\t] and leaving off the TIME_PREFIX, no change. I have tried: TIME_FORMAT=%Y-%m-%d%n%H:%M:%S TIME_FORMAT=%Y-%m-%d%t%H:%M:%S TIME_FORMAT=%Y-%m-%d<tab>%H:%M:%S Here is my props.conf: SHOULD_LINEMERGE=false TZ=GMT pulldown_type=true NO_BINARY_CHECK=1 TIME_PREFIX=[\t] MAX_TIMESTAMP_LOOKAHEAD=500 TIME_FORMAT=%Y-%m-%d%n%H:%M:%S REPORT-isawebw3c=isawebw3c transforms.conf: [isawebw3c] DELIMS = "\t" FIELDS="c-ip","cs-username","c-agent","sc-authenticated","date","time","s-svcname","s-computername","cs-referred","r-host","r-ip","r-port","time-taken","cs-bytes","sc-bytes","cs-protocol","cs-transport","s-operation","cs-uri","cs-mime-type","s-object-source","sc-status","s-cache-info","rule","FilterInfo","cs-Network","sc-Network","error-info","action","GMT-Time","AuthenticationServer" ... View more

I uploaded data into my system and created a TA that is CIM compliant. I will be doing this for several sources, all that come from different indexes. The issue I am having is that the queries in the app comes from several data models all that specify a sourcetype and no index, thus pulling from the default "main" index. Is there a way to specify indexes to use for each type of add-on? or does anyone know a good solution to this issue? ... View more

Is there an addon(TA-iis perhaps) that follows the CIM for IIS logs? ... View more