I have a field called eventtime in my logs, but the time is 19 characters long in epoch time (which goes to nanoseconds). The field is in the middle of the events, but I want to use it as the timestamp. However, when I, through the UI, define the TIME_PREFIX, it won't recognize it. However, there is another field that also has epoch time, but only 10 characters. When I use it, it works...just doesn't give me the nanoseconds. So, it's not a syntax issue. There are no periods in the timestamp. How can I fix this - using the UI for testing is easier to get feedback, but if I need to modify it in props.conf, that's fine? Additional context: The data comes in in json format, but only uses single quotes. I fixed this by using sedcmd in props.conf to swap the single quote with double quotes. In the TIME_PREFIX box (again, in the UI), I used single quotes as double quotes didn't work (which makes sense). 'eventtime': '1707613171105400540' 'itime_t': 1707613170'
... View more