topic Re: Timestamp broken up by a | in Getting Data In

Timestamp broken up by a |

ubko — Fri, 06 Apr 2012 16:52:05 GMT

Can I use this to pick out the date?

TIME_PREFIX = ^(?:[^\|]*\|){2}

How would I combine the time?

Re: Timestamp broken up by a |

araitz — Fri, 06 Apr 2012 18:19:06 GMT

Edit to reflect event given in comment below:

TIME_PREFIX=^(([^\|]+)?\|){16}
TIME_FORMAT=%Y%m%d|%H%M%S

Re: Timestamp broken up by a |

ubko — Mon, 28 Sep 2020 11:38:27 GMT

Doesn't work. Here's a sample event:

10|0012028284||55351|J|H|2|1|0|N|N|0|1|15-4-01 S 5||0|20110209|154343|20110209|154343|20110209|234343|1|1|0|1|0|0|-1|-1|

Here's the props.conf:

[test]
REPORT-test = test_fields
TIME_PREFIX = ^(([^|]+)|){16}
TIME_FORMAT = %Y%m%d|%H%M%S

Re: Timestamp broken up by a |

araitz — Fri, 06 Apr 2012 20:52:39 GMT

Yes, I would not expect it to work because the sample event above looks nothing like the event you just posted and the regex isn't properly constructed.

Re: Timestamp broken up by a |

ubko — Fri, 06 Apr 2012 21:53:23 GMT

This works:

TIME_PREFIX=^(([^|]*)|){16}

Thanks.