topic Re: transforms.conf INGEST_EVAL cannot get current time in Splunk Search

transforms.conf INGEST_EVAL cannot get current time

season88481 — Wed, 08 Jul 2020 13:16:20 GMT

Hi everyone,

I am trying to add a field for the current OS time.

Here is my props.conf and transforms.conf

#props.conf [mysourcetype] TRANSFORMS-getdate = get-current-date

#transforms.conf [get-current-date] INGEST_EVAL = current_date=now()

But I have this error:

ERROR regexExtractionProcessor - Error compiling INGEST_EVAL expression for get-current-date: Bad function

Is it a bug?

Cheers,

richgalloway — Wed, 08 Jul 2020 13:29:31 GMT

I suspect it is not a bug. Submit feedback at https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/IngestEval requesting a list of allowed functions in INGEST_EVAL.
As a workaround, consider using the existing _index_time field in place of current_date.

season88481 — Wed, 08 Jul 2020 22:27:51 GMT

Thanks richgalloway,

I found out using time() instead of now() can do the trick.

#props.conf [mysourcetype] TRANSFORMS-gettime = get-time-only

#transforms.conf [get-time-only] INGEST_EVAL = current_date=time()