Getting Data In

How to extract the timestamp from source at index-time to use as _time?

power12
Communicator

Hey Splunkers ,

How can I get the splunk to use time from source and use it as _time

Following are the two files it uses.One has date and time one has only date.

 

/project/admin/sv/re/sniff/pre/logs/2022-12-16T11-57-36/status
/project/aadmin/sv/re/sniff/pre/logs/2022-12-16/status

 

HOw do I write props and transforms for it

 

Thanks in Advance

Labels (2)
0 Karma

power12
Communicator

I tried using

| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%d")

But this only works for the one with date but not time...if I give
| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%dT%H-%M-%S")

This works with file source which has both date and time

 

 

What can I use that works for both time formats

 

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...