topic Re: Can I modify _time with an attribute in the event? in Getting Data In

Can I modify _time with an attribute in the event?

pfabrizi — Tue, 29 Sep 2020 18:13:31 GMT

We are bringing in symatec DLP events and we want _time to have the value of occurred_on.

occurred_on comes in like this:

February 27, 2018 2:39pm

Can I do this as a TIME_FORMAT in props.conf or can I use a field-alias in props.conf?

Thanks!

Re: Can I modify _time with an attribute in the event?

mayurr98 — Wed, 28 Feb 2018 11:45:05 GMT

Do this in props.conf

TIME_FORMAT = %B %d, %Y  %I:%M%p
TIME_PREFIX = occurred_on              //exact regex before time format

for example,if its coming occurred_on : "February 27, 2018 2:39pm" you should write TIME_PREFIX = occurred_on\s\:\s\"

Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!

Re: Can I modify _time with an attribute in the event?

pfabrizi — Wed, 28 Feb 2018 12:20:51 GMT

Thank You!