Hey Splunkers ,
How can I get the splunk to use time from source and use it as _time
Following are the two files it uses.One has date and time one has only date.
/project/admin/sv/re/sniff/pre/logs/2022-12-16T11-57-36/status
/project/aadmin/sv/re/sniff/pre/logs/2022-12-16/status
HOw do I write props and transforms for it
Thanks in Advance
I tried using
| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%d")
But this only works for the one with date but not time...if I give
| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%dT%H-%M-%S")
This works with file source which has both date and time
What can I use that works for both time formats