I have a log string as below - "@job_name_2017-03-21T19:54:21_Attempt=1 for df-064338422SQLJNNM4YNG started at 2017-03-21T23:05:08 was completed successfully", I want to capture the timestamp (_messageTime) from 2nd field (the one after "started at"), but sumo logic is using 1st field to parse the date. I tried "| parse "at * was" as date | toMillis(parseDate(start,"yyyy-MM-dd'T'HH:mm:ss")) as startInMillis", but this is not giving the correct timing. It is giving "Tue Mar 21 2017 23:05:08 GMT-0700", but the correct value is "Tue Mar 21 2017 16:05:08 GMT-0700". Any help ?
Please sign in to leave a comment.