Getting Data In

Props manipulate date

giuces
Engager

Hello,

I have to index a log file that has only the timestamp HH:MM:SS ,

HH:MM:SS field1 field2 ...

whenever a new row is added i should merge the actual date with the log timestamp YY/MM/DD HH:MM:SS .

i wasted a whole day to combining props and transforms configuration without success, Anyone can help me to solve ?

Thanks 

 

Labels (1)
0 Karma

ekenne06
Path Finder

in your props.conf, can you try setting 

DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = True

How far of a skew are the event times you are looking at with the system time? 

0 Karma

scelikok
Champion

Hi @giuces,

Splunk already adds the current date to timestamp is there is no in the log. Can you describe more why your are trying to add? Maybe a sample data and props.conf will help.

If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!