Any other way to compare between the same variable?

[ViniciusMariano]

Hey Guys,

I have a problem: I have two time fields because one of the type source is json file and there is another script running, but now I have to mix both, so I created this eval:

| eval _time=if(match(source, "[(\S).json]\w+"), strptime(time, "%Y/%m/%d %H:%M:%S.%f"), _time)

but when I search I just receive the .json file search, so Is there any other way to "join"?, or at least the "if" statement ignore and just modify the json source?

[richgalloway]

The regex used in the match function appears to match more than is intended.  Because of the dot with the square brackets, the expression will match anything.  Try this command:

| eval _time=if(match(source, "\S\.json\w"), strptime(time, "%Y/%m/%d %H:%M:%S.%f"), _time)