I found that the _time field in my event was a bit unusual
19756;10;7;mik;security;2017-08-04 10:57:33;test(20170731-20170804).xlsx;;1;0;et.exe;;
The _time field for this time is shown as follows: 17/08/04 20: 17: 08.040, accurate should be based on the event "2017-08-04 10:57:33" _time is 17/08/04 10: 57: 33.040.
I think the splunk matches the test in the event (20170731-20170804) .xlsx and then comes the _time, how do i let _time read the fifth; the number with the sixth; the date between the date
... View more