I try to parse out the timestamp of this line:
Jun 3 17:39:09 svlog.myserver.net svdcdev 04/29/2013 09:14:37 AM LogName=Security SourceName=Microsoft Windows security auditing.
I tried the following format during the input creation > Data Preview > Timestamp:
%m/%d/%Y %I:%M:%S %p
What is wrong with this format definition?
I hat to define a prefix to tell him, that he should not try to parse the first occuring but the second occuring timestamp:
TIME_PREFIX=[^\s]+[\s]+[^\s]+ [^\s]+ [^\s]+ [^\s]+