topic Re: How to apply source file date using INGEST as Time? in Getting Data In

How to apply source file date using INGEST as Time?

noott211 — Wed, 04 May 2022 04:48:32 GMT

There's no time in my log

You want to extract the source file date using the INGEST command

Source name /var/log/data_20220507.log

How can I add random time after the date over there?

i want _time = 2022/05/07 11:23:22.2

I would appreciate it if you could tell me the settings of Props.conf transforms.conf

Re: How to apply source file date using INGEST as Time?

isoutamo — Thu, 25 May 2023 08:22:30 GMT

FIXED: 2023-05-25

you can try something like this

props.conf

[source::/var/log/data_*.log] TRANSFORMS-set_time = set_time

transforms.conf

[set_time] INGEST_EVAL = _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")

Or test in GUI:

| makeresults | eval source="/var/log/data_20220507.log" | fields - _time ``` above set test data ``` | eval _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")

I haven't tested those files, just in GUI, so there could be some mistakes, but base idea is working.

r. Ismo

Re: How to apply source file date using INGEST as Time?

noott211 — Mon, 09 May 2022 01:38:46 GMT

Sorry for the delay in responding, the setting is not applied, and it appears in N/NaN/NaN form in the time file during the test.

And I want to format %Y/%m/%d %T

Re: How to apply source file date using INGEST as Time?

noott211 — Mon, 09 May 2022 02:10:36 GMT

A date format issue has been resolved, but logs are captured based on the current time. Is it a priority issue? I didn't do it No other time-related settings were performed.

Re: How to apply source file date using INGEST as Time?

isoutamo — Thu, 25 May 2023 08:25:00 GMT

I just fixed those props.conf and transforms.conf with the correct definitions.

Format of _time field is defined by your localisation. If you need to see it in another format then you should use some other field to show it in your needed way.

r. Ismo