Convert timestamps in transforms.conf?

[holtb]

I'm new to this wonderful app, so pardon my inexperience if this is easy...I have a very long search string, but I'd like to have these values created automatically on index. How could I convert this set of converts and calculations into a transform?

source="/sge/default/default/common/accounting" 
| eval "Wait Time"=start_time-submit_time 
| eval "Run Time"=end_time-start_time 
| eval "Submit Time"=strftime(submit_time,"%Y %b %d %H:%M:%S") 
| eval "Start Time"=strftime(start_time,"%Y %b %d %H:%M:%S") 
| eval "End Time"=strftime(end_time,"%Y %b %d %H:%M:%S") 
| table uid job_name project qname "Submit Time" wait_time "Start Time" "End Time" run_time failed

I tried doing it this way to no avail:

[accttimeconvert]
eval "Wait Time"=start_time-submit_time
eval "Run Time"=end_time-start_time
eval "Submit Time"=strftime(submit_time, "%Y/%m/%d %H:%M:%S")
eval "Start Time"=strftime(start_time, "%Y/%m/%d %H:%M:%S")
eval "End Time"=strftime(end_time, "%Y/%m/%d %H:%M:%S")

[dwaddle · Accepted solution]

This feature does not exist as of Splunk 4.3. Today, your best option is a macro that implements your series of eval operations.

There are rumours that the next major release of Splunk will support a feature quite similar to this. But, of course, the exact feature content of the next release is always subject to change. I would recommend keeping an eye out.

I think one thing to point out is that you don't necessarily want this done at index time, but rather at search time. The search-time late binding of field names to values is one of Splunk's strengths.