How to apply source file date using INGEST as Time?

[noott211]

There's no time in my log

You want to extract the source file date using the INGEST command

Source name  /var/log/data_20220507.log

How can I add random time after the date over there?

i want _time = 2022/05/07 11:23:22.2

I would appreciate it if you could tell me the settings of Props.conf transforms.conf

[isoutamo]

Hi

FIXED: 2023-05-25

you can try something like this

props.conf

[source::/var/log/data_*.log]
TRANSFORMS-set_time = set_time

transforms.conf

[set_time]
INGEST_EVAL = _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")

Or test in GUI:

| makeresults 
| eval source="/var/log/data_20220507.log" 
| fields - _time
``` above set test data ```
| eval _time = strptime(replace(source, ".*/data_(\d{8}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")

I haven't tested those files, just in GUI, so there could be some mistakes, but  base idea is working.

 r. Ismo

[noott211]

A date format issue has been resolved, but logs are captured based on the current time. Is it a priority issue? I didn't do it No other time-related settings were performed.

[isoutamo]

Hi

I just fixed those props.conf and transforms.conf with the correct definitions.

Format of _time field is defined by your localisation. If you need to see it in another format then you should use some other field to show it in your needed way.

r. Ismo

[noott211]

Sorry for the delay in responding, the setting is not applied, and it appears in N/NaN/NaN form in the time file during the test.

And I want to format %Y/%m/%d %T