When importing your data, specify the timestamp string in strptime format. This one worked for me using your example:
%Y-%m-%d/%H:%M:%S.%3N/%Z
Per the note above, if you're using Data Preview, should use strptime formatting. Docs:
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Modifyeventprocessing#Timestamps
Hello MuS,
Its not working for me.
i am trying set Timestamp on Data Preview.
Thanks
Gajanan
did you check the docs http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Configuretimestamprecognition ?
Hello Mus, I have tried without ^ bu no luck. its simple but i dont know where i am going wrong
This works on all those online regex testers .... try not to use any ^
or other special signs in the regex.
this works up til the timezone, if you need the TZ as well try this:
\d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}\/\w+
or a bit more compact regex like this:
(\d{2,4}[\-\/\:\.])+\w+