I'm using "From files and directories" --> "Upload and index a file" to feed the data file. The file has data in following format.
{ "_id": { "$oid": "4b97ca22729772ec85d48fc0"}, "subscriberId": "C10000235", "createTime": 1268238882453, "serviceGroup": "SGID0001", "sessionProtocolIndicator": null, "networkProxyId": "PROXY_001" }
Search shows the following basic information:
host=srinidev sourcetype=sds3 source=sds3.out
How can I get splunk (using 4.2.3) to recognize 1268238882453 as the date and use it as event time?
I added a $SPLUNK_HOME/etc/local/props.conf file with these lines:
[sds3]
TIME_PREFIX = createTime
TIME_FORMAT = %s
I also added $SPLUNK_HOME/etc/apps/search/input.conf, but with not much success.
Any help is greatly appreciated. Thanks.
... View more
