Getting Data In

What is the proper use of props.conf for timestamp conditional mapping

dhtran
Loves-to-Learn Lots

Hello,

I have the following data in plain text format that contains several datetime values, it looks like this :

XXXXXXXX201710101005582018101010055820191010100558

20171010100558 = date1
20181010100558 = date2
20191010100558 = date3

I have successfully configured props.conf to extract event timestamp from the first occurence (date1), using the following config :
TIME_FORMAT = %Y%m%d%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 22
TIME_PREFIX = .{8}

Now, things got complicated because date2 and date3 could be null, either 1 of the two, or both.

How can I configure properly props.conf, to handle the following rule :
- looks for date2 first, if exists, use it as event timestamp
- if date2 is null, looks for date3, if exists, use it as event timestamp
- if date2 and date3 are null, use date1 as event timestamp

Thanks in advance for your help.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Please generate an example of each of the cases. We need to understand what you mean by "null" - are they spaces, or something else?

0 Karma

dhtran
Loves-to-Learn Lots

by null I meant blank spaces
XXXXXXXX201710101005582018101010055820191010100558
XXXXXXXX20171010100558{14_spaces}20191010100558
XXXXXXXX2017101010055820181010100558{14_spaces}
XXXXXXXX20171010100558{14_spaces}{14_spaces}

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>