I found that the _time field in my event was a bit unusual
19756;10;7;mik;security;2017-08-04 10:57:33;test(20170731-20170804).xlsx;;1;0;et.exe;;
The _time field for this time is shown as follows: 17/08/04 20: 17: 08.040, accurate should be based on the event "2017-08-04 10:57:33" _time is 17/08/04 10: 57: 33.040.
I think the splunk matches the test in the event (20170731-20170804) .xlsx and then comes the _time, how do i let _time read the fifth; the number with the sixth; the date between the date
try using
TIME_PREFIX = ([^;];){5}
TIME_FORMAT = %Y-%m-%d %H:%M:%S
Bye.
Giuseppe
fix it with props.conf
explanation here, read all the way through the page
http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/HowSplunkextractstimestamps
hope it helps