Hello Guys,
I am facing issue with the _time field. Splunk is not recognizing the time properly, but all other things are working perfectly like _indextime and all.
I am attaching the screenshot for references.
I had even included following things in props.conf file on both the paths etc\system\local & etc\apps\TA_cisco_ios\local , but after doing that, still no luck
[cisco:acs]
# TIME_PREFIX = ^
# TIME_FORMAT = %B %d %H:%M:%S
# MAX_TIMESTAMP_LOOKAHEAD = 19
# SHOULD_LINEMERGE = false
# LINE_BREAKER = ([\r\n]+)(\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}\s)
# TRUNCATE = 999999
Any solutions to sort this out?
... View more