timestamp extraction from two places during index time within an event

[ankithreddy777]

I have an event like

"abcabcabc....abc.........time:-2017-05-05T0*8:08:08.987........abcxyz...abcxyz.....date:-2017-05-03*......"

I need to assign timestamp to each event at index time only , where date should be extracted from date field above and time value should be extracted from timestamp field.

Is there any possibility.
If I need to use datatime_renamed.xml . May I know what changes to be made in file?

[niketn]

@ankithreddy777, if time:-2017-05-05T* prefixes the time which you want Splunk to pick and also the date that you want to avoid you can use TIME_PREFIX regex to skip this.

Try the following props.conf settings (where 57 is number for characters to look ahead in order to find date. Based on sample data it is ........abcxyz...abcxyz.....date:-. You can change 57 to a different number based on actual estimated number of characters.

TIME_PREFIX=time:-\d{4}-\d{2}-\d{2}T\d*
MAX_TIMESTAMP_LOOKAHEAD=57

[SuryaNittala]

Can you paste the sample event. You can achieve this by configuring TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD in props.conf