Getting Data In

Multiple Time Sources in Event Log


I have an event in my log that contains the following information

* Event Time
* Post Event Time 1
* Post Event Time 2
* Post Event Time 3

The original event sends the time as UTC+0. I have adjusted my sourcetype to set the TZ as required and the logs are now coming in with the appropriate offset into SPLUNK instance. For example the TZ is set to +8. If my time was 12:30pm then the log comes through as follows for example:

* Event Time ==> 12:30pm 09/04/2020 ==> this is accurate as my props is doing what I want it to do.  

The problem is that the other time fields in the event (the source is CEF) show as "alphabetic" fields (string) so not true times.

* PostTime1 ==> APR 09 04:30:00
* PostTime2 ==> APR 09 04:30:00
* PostTime 3 ==> APR 09 04:30:00

I can adjust the times by using strp/strf time to get what I need but what I would like to know is can I do this at ingest time (so via something like props/transforms) as opposed to in a search? The Event Time (ingest time) works exactly as required so that doesnt need to change. This is purely for the other non "_time" fields.

Tags (1)
0 Karma

Ultra Champion

add TZ_ALIAS and use TRANSFORMS and INGEST_EVAL on transforms.conf

0 Karma


I assume you mean TZ_ALIAS?

Ingest eval I have not used before. The doco says only works for indexed time so it doesnt seem to meet my requirement...? Is there any example code on how this would be done?

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...