Getting Data In

Use source path time when ingesting data

power12
Communicator

I have the following source .I want to extract time from source when data is ingesting

 

source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log"

 

in props 

 

TRANSFORMS-set_time =source_path_time

 

 

In transforms 

 

[set_time_from_file_path]
INGEST_EVAL = | eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S")

 

 

 

I tried testing it but I am unable to get the _time

 

| makeresults 
| eval source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log" 
| fields - _time
``` above set test data ```
| eval _time = strptime(replace(source, ".*/compute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S")

 

 

Thanks in Advance

Labels (3)
0 Karma
1 Solution

power12
Communicator

Thank You @victor_menezes  .I tried below and it worked .

| eval _time = strptime(replace(source, ".*(\d\d\d\d-\d\d-\d\d\_\d\d-\d\d-\d\d).*","\1"),"%Y-%m-%d_%H-%M-%S")

View solution in original post

0 Karma

victor_menezes
Communicator

Your props is not matching the stanza name of transforms. Not sure if that was a typo...
About a typo, you don't need that first pipe in the ingest_eval. Try this instead (I changed the regex a bit)

Props.conf:
[your_sourcetype]
TRANSFORMS-set_time = set_time_from_file_path

Transforms.conf
[set_time_from_file_path]
INGEST_EVAL = eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z]+)/([^/]+/[^/]+).*","\\1"), "%Y-%m-%d_%H-%M-%S")

power12
Communicator

Thank You @victor_menezes  .I tried below and it worked .

| eval _time = strptime(replace(source, ".*(\d\d\d\d-\d\d-\d\d\_\d\d-\d\d-\d\d).*","\1"),"%Y-%m-%d_%H-%M-%S")

0 Karma

victor_menezes
Communicator

Awesome! Glad to know that.

Please remember to mark this as resolved so others can know about it.

Happy splunking!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...