I am working with a | delimited field log. The second column is the jdate and the third column appears to be a epoch time. The julian date is formatted as year, day of the year... 15 = 2015 and 085 = 3/26/15. I am guessing the time is formatted as hh:mm:ss.
field1|15085|232038|
field1|15085|231633|
field1|15085|203812|
field1|15085|203812|
props.conf is defined as the following:
FIELD_DELIMITER = |
FIELD_NAMES = type,jdate,time,.....
TIMESTAMP_FIELDS = jdate,time
TIME_FORMAT = %Y%m%d %H%M%S
The data is indexing into Splunk and then it will stop for a couple of days and restart. Looking at _internal index, the following error message is populated:
A possible timestamp match (Fri Jan 4 05:24:39 2008) is outside of the acceptable time window.
I know the time stamp format is off, but I am not sure how to adjust it. Looking for suggestions if anyone else experienced this.
Thanks, Jenn
... View more