We have a report from a system that needs to be indexed into splunk on monthly basis. This report is generated on 1st day of every month.
Our requirement is to index events in this report on last day of previous month. So i want to index data from this report with timestamp of previous day.
Is this possible?
I added following in props.conf and transforms.conf to get the desired results,
transforms.conf
[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400
props.conf
[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday
I added following in props.conf and transforms.conf to get the desired results,
transforms.conf
[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400
props.conf
[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday
Hi
I'm not sure if I understood right your question, but you could get last month events by the next query:
index=_internal earliest=-1mon@mon latest=-0mon@mon
| stats earliest(_time) as eTime latest(_time) as lTime
| eval eTime = strftime(eTime, "%F %T %z"), lTime = strftime(lTime, "%F %T %z")
| table eTime lTime
To show reports day e.g. as last day of previous month just take day part of lTime (I suppose that you have events on it).
r. Ismo
Thanks for your response @isoutamo , but my question is to manipulate timestamp during indexing events.
During event indexing there are settings in sourcetype like Auto, Current, Advanced and Configuration file. I would like to know if there is a way to set timestamp to be (current time - 1 day)
thanks @isoutamo for showing right direction