Getting Data In

How to extract the timestamp from source at index-time to use as _time?

power12
Communicator

Hey Splunkers ,

How can I get the splunk to use time from source and use it as _time

Following are the two files it uses.One has date and time one has only date.

 

/project/admin/sv/re/sniff/pre/logs/2022-12-16T11-57-36/status
/project/aadmin/sv/re/sniff/pre/logs/2022-12-16/status

 

HOw do I write props and transforms for it

 

Thanks in Advance

Labels (2)
0 Karma

power12
Communicator

I tried using

| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%d")

But this only works for the one with date but not time...if I give
| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%dT%H-%M-%S")

This works with file source which has both date and time

 

 

What can I use that works for both time formats

 

 

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...