topic Re: Time field extraction and transformation in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction-and-transformation/m-p/165270#M33523 <P>Yes. You can do EVAL statements in props.conf:</P> <PRE><CODE>EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z") </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf</A></P> Wed, 04 Dec 2013 07:49:57 GMT Ayn 2013-12-04T07:49:57Z Time field extraction and transformation https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction-and-transformation/m-p/165269#M33522 <P>Big Picture: I need to extract a time stamp from my data and pass it in a specific format in a URI GET request to a third party appliance. My issue arises with the format Splunk uses for _time. </P> <P>Splunk: _time = 2013-12-03T00:46:32.000-05:00<BR /> I need: mytime= 2013-11-26T23:59:59-0500<BR /> Year-Month-DayT24Hour:Minute:Second-UTCoffset</P> <P>I came up with a work around macro to get around the extraction and transformation issue. The macro I used is eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S%z"). Downside to using a macro is that it needs to be called at search time by the user. I'd like to use something transparent. I am asking the Splunk community for help. Can this extractions/transformation be done invisibly behind to scenes? Could I use transforms.conf and props.conf?</P> Wed, 04 Dec 2013 06:14:36 GMT https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction-and-transformation/m-p/165269#M33522 rgaleone1 2013-12-04T06:14:36Z Re: Time field extraction and transformation https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction-and-transformation/m-p/165270#M33523 <P>Yes. You can do EVAL statements in props.conf:</P> <PRE><CODE>EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z") </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf</A></P> Wed, 04 Dec 2013 07:49:57 GMT https://community.splunk.com/t5/Getting-Data-In/Time-field-extraction-and-transformation/m-p/165270#M33523 Ayn 2013-12-04T07:49:57Z