Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.
Here are the entries in my props.conf file:
TIME_PREFIX=^([^,]*,){14}
TIME_FORMAT=%Y%m%d%H%M%S.%q%Z
I used the regex for the timestamp based on this post here:
http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event
Any advice would be appreciated.
