There's no time in my log
You want to extract the source file date using the INGEST command
Source name /var/log/data_20220507.log
How can I add random time after the date over there?
i want _time = 2022/05/07 11:23:22.2
I would appreciate it if you could tell me the settings of Props.conf transforms.conf
Hi
FIXED: 2023-05-25
you can try something like this
props.conf
[source::/var/log/data_*.log]
TRANSFORMS-set_time = set_time
transforms.conf
[set_time]
INGEST_EVAL = _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")
Or test in GUI:
| makeresults
| eval source="/var/log/data_20220507.log"
| fields - _time
``` above set test data ```
| eval _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")
I haven't tested those files, just in GUI, so there could be some mistakes, but base idea is working.
r. Ismo
A date format issue has been resolved, but logs are captured based on the current time. Is it a priority issue? I didn't do it No other time-related settings were performed.
Hi
I just fixed those props.conf and transforms.conf with the correct definitions.
Format of _time field is defined by your localisation. If you need to see it in another format then you should use some other field to show it in your needed way.
r. Ismo
Sorry for the delay in responding, the setting is not applied, and it appears in N/NaN/NaN form in the time file during the test.
And I want to format %Y/%m/%d %T