Can I modify _time with an attribute in the event?

[pfabrizi]

We are bringing in symatec DLP events and we want _time to have the value of occurred_on.

occurred_on comes in like this:

February 27, 2018 2:39pm

Can I do this as a TIME_FORMAT in props.conf or can I use a field-alias in props.conf?

Thanks!

[mayurr98 · Accepted solution]

Do this in props.conf

TIME_FORMAT = %B %d, %Y  %I:%M%p
TIME_PREFIX = occurred_on              //exact regex before time format

for example,if its coming occurred_on : "February 27, 2018 2:39pm" you should write TIME_PREFIX = occurred_on\s\:\s\"

Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!

[pfabrizi]

Thank You!