timeformat is not desired, I tried SEDCMD to correct it(12-hour format with 'am','pm')
props.conf of INDEXER:
SEDCMD-timechar=s/XXXXX/AM/g s/YYYYY/PM/g
TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p
but '%p' is not recognized, as SEDCMD has not been effective in the same props.conf.
I wonder if i can put SEDCMD to UNIVERSALFORWARDER, and TIME_FORMART remain on INDEXER?
Hello
SEDCMD happens at the parsing stage, so it applies in a heavy forwarder or in a indexer.
Regards
Hello
SEDCMD happens at the parsing stage, so it applies in a heavy forwarder or in a indexer.
Regards
'TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p' is correct when i manully modified source data with AM/PM
and 'SEDCMD' part is also effective of replacing XXYY with AM/PM
But they do not work together.
If your config is correct it should work on the indexer, or you can use a heavy forwarder too. Anyway try it locally in the indexer until it works, then move your configs into the production enviroment.
thank you!
do you have any idea to solve my problem:
timestamp form '22-1-14 09.30.00.000000000 \A\C' in which '\A\C' means PM