I have an example log file with the following format:
Nov 05 10:33:37 servername applicationserver: instance,ipaddress,[05/Nov/2011:10:33:33 +0000]
I would like the second time column which contains [05/Nov/2011:10:33:33 +0000] to be column which is used for _time at index time, currently by default it uses Nov 05 10:33:37.
Any suggestion on how to tech splunk to use the alternative timestamp for _time would be appreciated.
Thanks
Please create only one post per question:
Please see following manual. Hope this help.
http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Configuretimestamprecognition