I have a lot of DB Connect inputs connecting to MS SQL databases. a lot of the data i am pulling from these inputs have multiple date/time fields. Ususally one of the fields is my output timestamp and that will get read correctly. The other date/time fields will end up being converted by splunk to Epoch time. would i need a stanza in props.conf to address this and if so would i need to identify the fields in the stanza?
... View more