Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Parsing the following sourcetype for a custom field extraction on a single field, why is only "Nov" extracted instead of the full date?

$
0
0
When parsing the following sourcetype, the field Example1 results in "Nov" instead of the full date. The rest of the fields are extracted properly. I'm wondering, is there anything specific I need to add to props/transforms for this? Nov 2 2015 11:06:00:200AM , Example1=Nov 2 2015 11:06:00:260AM , Example2=ALONGNUMBER, Example3=7 , Example4=7 , Example5=STANDARD, Example6=AGuestAccount , Example7=SomeCommand, Example8=example-server, Example9=5992, Example10=60

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>