topic Re: Adding Multiple time stamp fields in props file sourcetype stanza in Getting Data In

Adding Multiple time stamp fields in props file sourcetype stanza

k_harini — Tue, 29 Sep 2020 11:41:18 GMT

I have a source file with multiple dates and timestamp as separate fields. I want to use last_changed and last_changed_time fields..
Both are in different format
last_changed = %d.%m.%Y
last_changed_time = %H:%M:%S %p

While defining sourcetype - Timestamp fields - last_changed,last_changed_time ... How to give timestamp format since 2 fields are present in timestamp fields? Please suggest!

Re: Adding Multiple time stamp fields in props file sourcetype stanza

niketn — Mon, 07 Nov 2016 13:18:20 GMT

can you add some sample events?

Re: Adding Multiple time stamp fields in props file sourcetype stanza

gcusello — Tue, 29 Sep 2020 11:46:18 GMT

Hi k_harini,
if you could share an example will be more efficient.
Every way, if you have something like this:
01.11.2016|01.11.2016|02.11.2016|11:58:56 AM|11:58:57 AM|11:59:09 AM
and you need to take the first and the fourth fields, you could use in TIMESTAMP_FORMAT something like this %d.%m.%Y\|\d+\.\d+\.\d+\|\d+\.\d+\.\d+\|%H:%M:%S %p

Bye.
Giuseppe