https://community.splunk.com/t5/Getting-Data-In/Convert-timestamps-in-transforms-conf/m-p/39965#M7426 <P>This feature does not exist as of Splunk 4.3. Today, your best option is a macro that implements your series of <CODE>eval</CODE> operations.</P> <P>There are rumours that the next major release of Splunk will support a feature quite similar to this. But, of course, the exact feature content of the next release is always subject to change. I would recommend keeping an eye out.</P> <P>I think one thing to point out is that you don't necessarily want this done at <STRONG>index</STRONG> time, but rather at search time. The search-time late binding of field names to values is one of Splunk's strengths.</P> Tue, 21 Aug 2012 00:24:31 GMT dwaddle 2012-08-21T00:24:31Z https://community.splunk.com/t5/Getting-Data-In/Convert-timestamps-in-transforms-conf/m-p/39964#M7425 <P>I'm new to this wonderful app, so pardon my inexperience if this is easy...I have a very long search string, but I'd like to have these values created automatically on index. How could I convert this set of converts and calculations into a transform?</P> <PRE><CODE>source="/sge/default/default/common/accounting" | eval "Wait Time"=start_time-submit_time | eval "Run Time"=end_time-start_time | eval "Submit Time"=strftime(submit_time,"%Y %b %d %H:%M:%S") | eval "Start Time"=strftime(start_time,"%Y %b %d %H:%M:%S") | eval "End Time"=strftime(end_time,"%Y %b %d %H:%M:%S") | table uid job_name project qname "Submit Time" wait_time "Start Time" "End Time" run_time failed </CODE></PRE> <P>I tried doing it this way to no avail:</P> <PRE><CODE>[accttimeconvert] eval "Wait Time"=start_time-submit_time eval "Run Time"=end_time-start_time eval "Submit Time"=strftime(submit_time, "%Y/%m/%d %H:%M:%S") eval "Start Time"=strftime(start_time, "%Y/%m/%d %H:%M:%S") eval "End Time"=strftime(end_time, "%Y/%m/%d %H:%M:%S") </CODE></PRE> Mon, 20 Aug 2012 23:35:15 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-timestamps-in-transforms-conf/m-p/39964#M7425 holtb 2012-08-20T23:35:15Z https://community.splunk.com/t5/Getting-Data-In/Convert-timestamps-in-transforms-conf/m-p/39965#M7426 <P>This feature does not exist as of Splunk 4.3. Today, your best option is a macro that implements your series of <CODE>eval</CODE> operations.</P> <P>There are rumours that the next major release of Splunk will support a feature quite similar to this. But, of course, the exact feature content of the next release is always subject to change. I would recommend keeping an eye out.</P> <P>I think one thing to point out is that you don't necessarily want this done at <STRONG>index</STRONG> time, but rather at search time. The search-time late binding of field names to values is one of Splunk's strengths.</P> Tue, 21 Aug 2012 00:24:31 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-timestamps-in-transforms-conf/m-p/39965#M7426 dwaddle 2012-08-21T00:24:31Z