Getting Data In

Time field extraction and transformation

rgaleone1
Path Finder

Big Picture: I need to extract a time stamp from my data and pass it in a specific format in a URI GET request to a third party appliance. My issue arises with the format Splunk uses for _time.

Splunk: _time = 2013-12-03T00:46:32.000-05:00
I need: mytime= 2013-11-26T23:59:59-0500
Year-Month-DayT24Hour:Minute:Second-UTCoffset

I came up with a work around macro to get around the extraction and transformation issue. The macro I used is eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S%z"). Downside to using a macro is that it needs to be called at search time by the user. I'd like to use something transparent. I am asking the Splunk community for help. Can this extractions/transformation be done invisibly behind to scenes? Could I use transforms.conf and props.conf?

0 Karma
1 Solution

Ayn
Legend

Yes. You can do EVAL statements in props.conf:

EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z")

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

0 Karma

Ayn
Legend

Yes. You can do EVAL statements in props.conf:

EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z")

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...