topic Re: How to assign timestamp for an event from two different fields in Getting Data In

How to assign timestamp for an event from two different fields

ankithreddy777 — Tue, 29 Sep 2020 13:58:35 GMT

I have an event like

"abcabcabc....abc..timestamp:-2017-05-05T*08:08:08.987.....abc...abc.....date:-2017-05-03*......""

I need to assign _time where date should be extracted from date field and time value should be extracted from timestamp field.
Is there any possibility.

If I need to use datatime_renamed.xml , where I should place this new resulting file. Does this effect existing settings on other indexes.

Re: How to assign timestamp for an event from two different fields

jkat54 — Sun, 07 May 2017 12:55:20 GMT

| rex "(?<time>\d{2}:\d{2}:\d{2}\.\d{3})" 
| rex "date:-(?<date>\d{4}-\d{2}-\d{2})"
| eval datetime=strftime(date."T".time, "%FT%T.%3N")
| table datetime

Re: How to assign timestamp for an event from two different fields

adonio — Sun, 07 May 2017 13:55:23 GMT

Beautiful,
regarding the second part of the question, @jkat54 used the erx command to extract the timeestamp which means its at search time. it will not affect other settings