Hello Splunkers ,
I have the following source file which has the date/time in it .. How do I write the props and transforms to use the source date/time as the _time
Below is the sample file
/project/admin/sv/re/sniff/pre/logs/2022-12-16T11-57-36/status
i want the _time or indexed time to be 2022-12-16 11-57-36.
Thanks in Advance
Hi
Another way is use to INGEST_EVAL. I cannot say which one is more efficient.
Add props.conf
[<source or sourcetype name>]
TRANSFORMS-set_time = set_time_from_file_path
transforms.conf
[set_time_from_file_path]
INGEST_EVAL = _time = strptime(replace(source, ".*(\d{4}-\d\d-\d\dT\d\d-\d\d-\d\d)/status","\1"),"%Y-%m-%dT%H-%M-%S")
You also need to check TZ information should you add it here or not? Definitely needs if you have source systems on different timezones and/or source systems and indexers / HFs are on different TZ.
r. Ismo
Hi @power12,
you have to configure datetime_config.xml and point to it in props.conf:
props.conf:
[your_sourcetype]
DATETIME_CONFIG = /opt/splunk/etc/apps/your_app/local/datetime.xml
in datetime_config.xml:
<datetime>
<define name="_timeAndDateFromFilename" extract="year, month, day, hour, minute, second">
<text><![CDATA[source::\/project\/admin\/sv\/re\/sniff\/pre\/logs\/?(\d{4})-(\d{2})-(\d{2}T(\d{2})-(\d{2})-(\d{2})]]></text>
</define>
<timePatterns>
<use name="_timeAndDateFromFilename"/>
</timePatterns>
</datetime>
As described at https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configuredatetimexml#Examples_of_custom_date...
Ciao.
Giuseppe
@gcusello Thank you for your message...do you think there is a ) missing before the T
(\d{4})-(\d{2})-(\d{2}T(\d{2})-(\d{2})-(\d{2})
(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})
hi @power12 ,
good for you, see next time!
Please accept one answer for the other people of Community
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉