Getting Data In

Adding Multiple time stamp fields in props file sourcetype stanza

k_harini
Communicator

I have a source file with multiple dates and timestamp as separate fields. I want to use last_changed and last_changed_time fields..
Both are in different format
last_changed = %d.%m.%Y
last_changed_time = %H:%M:%S %p

While defining sourcetype - Timestamp fields - last_changed,last_changed_time ... How to give timestamp format since 2 fields are present in timestamp fields? Please suggest!

Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi k_harini,
if you could share an example will be more efficient.
Every way, if you have something like this:
01.11.2016|01.11.2016|02.11.2016|11:58:56 AM|11:58:57 AM|11:59:09 AM
and you need to take the first and the fourth fields, you could use in TIMESTAMP_FORMAT something like this %d.%m.%Y\|\d+\.\d+\.\d+\|\d+\.\d+\.\d+\|%H:%M:%S %p

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi k_harini,
if you could share an example will be more efficient.
Every way, if you have something like this:
01.11.2016|01.11.2016|02.11.2016|11:58:56 AM|11:58:57 AM|11:59:09 AM
and you need to take the first and the fourth fields, you could use in TIMESTAMP_FORMAT something like this %d.%m.%Y\|\d+\.\d+\.\d+\|\d+\.\d+\.\d+\|%H:%M:%S %p

Bye.
Giuseppe

0 Karma

niketn
Legend

can you add some sample events?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...