Timestamp format with leading hash sign, #Fri Aug 31 14:37:21 2012

[jmgilpin]

Any suggestions on the format that I could use to extract this timestamp?

#Fri Aug 31 14:37:21 2012

thanks,

James

[vnravikumar · Accepted solution]

Hi

Check this

| makeresults 
| eval temp="#Fri Aug 31 14:37:21 2012" 
| eval epoch =strptime(temp,"#%a %b %d %H:%M:%S %Y") 
| eval result = strftime(epoch,"%d/%m/%Y %H:%M:%S")

[jmgilpin]

thanks, works great inline

Also, for sourcetype, I used TIME_PREFIX=#