Hi all, i want to change the timestamp on event: I want put the createDteTime on Time (yellow) I changed the props.conf as follow:     [sourcetype] INDEXED_EXTRACTIONS = json TIMESTAMP_FIELDS = createdDateTime\": TIME_FORMAT = %FT%TZ     But at the moment does not work. Any idea? Thanks! ... View more

Hello, I have installed the splunk enterprise free version on my pc and i have installed the app Splunk app for lookup file edting but unfortunatly doesn't works. When i try to upload a file .csv i have the following error "File is binary or file encoding is not supported, only utf-8 encoded files are supported splunk". I tried to change the permission on the app's folder on windows but i did not resolve the problem. I tested with a very easy csv, and this one is the result: In the csv the column test3,test,test2 were divided. I saved the .csv in all format. Thanks for the support! ... View more