On Mar 21, 2019, at 10:19 AM, Igor Smitran <sigor at blic.net> wrote: > In the mean time i am changing SQL queries and i am trying to use Event-Timestamp if it exists, otherwise '%S'. > > Would this be ok to use in SQL conf: > > %{%{Event-Timestamp}:-'%S'} That should work. Alan DeKok.