Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

TIME_PREFIX regex help

$
0
0

Hi,

I seem to be incapable of figuring out what regex to provide in the TIME_PREFIX for my source type in order to recognize the second time stamp instead of the first.

Please see a sample event below

"Jun 04 2013 12:00:00:001AM","5333079266","310410257633304","8","Jun 03 2013 03:55:43:000PM"

Thanks


Viewing all articles
Browse latest Browse all 13053

Trending Articles