This may have been asked before, but I can't find answer that solves my problem.
First time using Splunk community edition. I upload a file with json records, each record has many fields, two of them are timestamp related:
createdAt: 2014/11/16 19:21:04 +0000
updatedAt: 2014/11/16 19:22:15 +0000
I used Timestamp format: %Y/%m/%d %H:%M:%S +0000
But I got error:
Could not use strptime to parse timestamp from ...Failed to parse timestamp. Defaulting to file modtime
Any idea what I have done wrong. Thanks.
You should use this:
TIME_FORMAT = %Y/%m/%d %H:%M:%S %z