When parsing the following sourcetype, the field Example1 results in "Nov" instead of the full date. The rest of the fields are extracted properly. I'm wondering, is there anything specific I need to add to props/transforms for this?
Nov 2 2015 11:06:00:200AM , Example1=Nov 2 2015 11:06:00:260AM , Example2=ALONGNUMBER, Example3=7 , Example4=7 , Example5=STANDARD, Example6=AGuestAccount , Example7=SomeCommand, Example8=example-server, Example9=5992, Example10=60
↧