Big Picture: I need to extract a time stamp from my data and pass it in a specific format in a URI GET request to a third party appliance. My issue arises with the format Splunk uses for _time.
Splunk: _time = 2013-12-03T00:46:32.000-05:00
I need: mytime= 2013-11-26T23:59:59-0500
Year-Month-DayT24Hour:Minute:Second-UTCoffset
I came up with a work around macro to get around the extraction and transformation issue. The macro I used is eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S%z"). Downside to using a macro is that it needs to be called at search time by the user. I'd like to use something transparent. I am asking the Splunk community for help. Can this extractions/transformation be done invisibly behind to scenes? Could I use transforms.conf and props.conf?
