We are bringing in symatec DLP events and we want _time to have the value of occurred_on.
occurred_on comes in like this:
February 27, 2018 2:39pm
Can I do this as a TIME_FORMAT in props.conf or can I use a field-alias in props.conf?
Thanks!
↧