Getting Data In

Time field extraction and transformation

rgaleone1
Path Finder

Big Picture: I need to extract a time stamp from my data and pass it in a specific format in a URI GET request to a third party appliance. My issue arises with the format Splunk uses for _time.

Splunk: _time = 2013-12-03T00:46:32.000-05:00
I need: mytime= 2013-11-26T23:59:59-0500
Year-Month-DayT24Hour:Minute:Second-UTCoffset

I came up with a work around macro to get around the extraction and transformation issue. The macro I used is eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S%z"). Downside to using a macro is that it needs to be called at search time by the user. I'd like to use something transparent. I am asking the Splunk community for help. Can this extractions/transformation be done invisibly behind to scenes? Could I use transforms.conf and props.conf?

0 Karma
1 Solution

Ayn
Legend

Yes. You can do EVAL statements in props.conf:

EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z")

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

0 Karma

Ayn
Legend

Yes. You can do EVAL statements in props.conf:

EVAL-mytime = strftime(_time,"%Y-%m-%dT%H:%M:%S%z")

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...