Hi All, We are trying to parse the Event time as below. But because of the spaces present in between the Event time are not parsing properly.
As mentioned in the screen shot.
If you are still facing this issue, the solution is you got to take each attribute separately. For instance, "Apr" as "month" "12" as "date" and so on.. Space serves as a delimiter while building a parser so if you add entire string with spaces as one variable statement (Event_time_string in your example) the result will be like this.
yes, we used the same and tried to use a group function to convert the same to event.time. But this is throwing error after loading the parser to decoder.
Can you please verify the evnet time function with functions="<@event_time:*EVNTTIME($HDR,'%B %F %N:%U:%O',time)>"
Reference: Log Parser Tool v1.1 User Guide page 36
Retrieving data ...