We are bringing in symatec DLP events and we want _time to have the value of occurred_on.
occurred_on comes in like this:
February 27, 2018 2:39pm
Can I do this as a TIME_FORMAT in props.conf or can I use a field-alias in props.conf?
Thanks!
Do this in props.conf
TIME_FORMAT = %B %d, %Y %I:%M%p
TIME_PREFIX = occurred_on //exact regex before time format
for example,if its coming occurred_on : "February 27, 2018 2:39pm"
you should write TIME_PREFIX = occurred_on\s\:\s\"
Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!
Do this in props.conf
TIME_FORMAT = %B %d, %Y %I:%M%p
TIME_PREFIX = occurred_on //exact regex before time format
for example,if its coming occurred_on : "February 27, 2018 2:39pm"
you should write TIME_PREFIX = occurred_on\s\:\s\"
Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!
Thank You!