topic How to concatenate 2 fields to create a timestamp at import stage in Getting Data In

How to concatenate 2 fields to create a timestamp at import stage

virginiehang — Fri, 13 Apr 2018 09:16:47 GMT

Hello,

I need to import the below file:

<MessageEmissionDate>2017-12-04</MessageEmissionDate>
 <MessageEmissionTime>11:18:00 </MessageEmissionTime>

The timestamp should be the concatenation of Date and Time.... to be like 2017-12-04 11:18:00. How can I do that?

Re: How to concatenate 2 fields to create a timestamp at import stage

adonio — Mon, 16 Apr 2018 18:14:47 GMT

hello there,

created small file with only the combination of the fields for timestamp and one line of data:

<MessageEmissionDate>2017-12-04</MessageEmissionDate>
 <MessageEmissionTime>11:18:00 </MessageEmissionTime>
<someData>data1</someData>
<MessageEmissionDate>2017-12-04</MessageEmissionDate>
 <MessageEmissionTime>12:18:00 </MessageEmissionTime>
<someData>data2</someData>
<MessageEmissionDate>2017-12-04</MessageEmissionDate>
 <MessageEmissionTime>13:18:00 </MessageEmissionTime>
<someData>data3</someData>
<MessageEmissionDate>2017-12-04</MessageEmissionDate>
 <MessageEmissionTime>14:18:00 </MessageEmissionTime>
<someData>data4</someData>

was able to extract correct timestamp with these props:

[ sourcetype_here ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
MUST_BREAK_AFTER=</someData>
TIME_PREFIX=<MessageEmissionDate>

see screenshot below:

hope it helps

if it doesnt solve it, can you kindly provide sample data (full event/s)

Re: How to concatenate 2 fields to create a timestamp at import stage

virginiehang — Tue, 17 Apr 2018 19:37:39 GMT

@adonio thanks for your help! it is ok on my side now!