Getting Data In

How to extract the timestamp from source at index-time to use as _time?

power12
Communicator

Hey Splunkers ,

How can I get the splunk to use time from source and use it as _time

Following are the two files it uses.One has date and time one has only date.

 

/project/admin/sv/re/sniff/pre/logs/2022-12-16T11-57-36/status
/project/aadmin/sv/re/sniff/pre/logs/2022-12-16/status

 

HOw do I write props and transforms for it

 

Thanks in Advance

Labels (2)
0 Karma

power12
Communicator

I tried using

| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%d")

But this only works for the one with date but not time...if I give
| eval _time=strptime(replace(source,".*logs/",""),"%Y-%m-%dT%H-%M-%S")

This works with file source which has both date and time

 

 

What can I use that works for both time formats

 

 

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...