I have an example log file with the following format:
Nov 05 10:33:37 servername applicationserver: instance,ipaddress,[05/Nov/2011:10:33:33 +0000]
I would like the second time column which contains [05/Nov/2011:10:33:33 +0000] to be column which is used for _time at index time, currently by default it uses Nov 05 10:33:37.
Any suggestion on how to tech splunk to use the alternative timestamp for _time would be appreciated.
The question has been closed for the following reason "Duplicate Content" by araitz 15 Nov '11, 09:35
Please see following manual. Hope this help.
answered 15 Nov '11, 08:40